Provides an injectable EncryptionService that encrypts/decrypts strings
with AES-256-GCM using a key derived from APP_SECRET with domain
separation. Payloads are base64 JSON envelopes with validated IV and
auth tag lengths, and failures surface as typed errors.