Encrypt pages at rest with a key per person

Pages are sealed with AES-256-GCM. Each person's key is derived (HKDF) from a master key in the settings file plus their Authentik issuer and subject. Plain files from earlier versions are read and re-saved encrypted. Mako refuses to open a notebook it cannot decrypt rather than overwrite it.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/mako/main.go

@@ -99,7 +99,7 @@ func serve(args []string) error {
 	if err != nil {
 		return configError{err}
 	}
-	if !h.Exists() { // writing it now is what makes the generated secret stick
+	if h.NeedsSave() { // writing it now is what makes the generated secret and key stick
 		if err := h.Save(); err != nil {
 			return fmt.Errorf("could not write %s: %w", *path, err)
 		}