fix(session): restore encryption-at-rest — encrypt in Session, not storage layer

[usernane]

Summary

Fixes a security regression in the v3.1.0 per-key session system where SESSION_KEY encryption was silently dropped.

Problem

The old whole-blob session serialization encrypted the entire session with AES-256-GCM when SESSION_KEY was set. The new per-key storage system wrote values as plain JSON, ignoring SESSION_KEY entirely.

Fix

Encryption belongs in Session, not in a storage wrapper. Session owns its ID (used as a salt in key derivation), knows SESSION_KEY, and is the correct owner of what enters and leaves storage. Storage backends stay storage-only.

• Session::encryptValue() — AES-256-GCM encrypt before storage->write()
• Session::decryptValue() — decrypt after storage->read()
• Applied in set(), get(), getVars(), refresh(), start() snapshot, writeWithRetry()
• Key: SHA-256(SESSION_KEY + sessionId), matching old whole-blob scheme
• Graceful fallback: no SESSION_KEY = no-op; non-ENC: values pass through

Tests

5 new tests in SessionEncryptionTest: encrypted at rest, transparent get, round-trip across instances, getVars, remove.

Checklist

• No EncryptedSessionStorage class — correct layering, storage stays storage-only
• cs-fixer clean
• No FQCN

[codecov]

Codecov Report

❌ Patch coverage is 63.41463% with 15 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.68%. Comparing base (9d55048) to head (d3fd28e).

Files with missing lines	Patch %	Lines
WebFiori/Framework/Session/Session.php	63.41%	15 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #417      +/-   ##
============================================
- Coverage     82.42%   81.68%   -0.74%     
- Complexity     3265     3279      +14     
============================================
  Files           106      106              
  Lines          9654     9685      +31     
============================================
- Hits           7957     7911      -46     
- Misses         1697     1774      +77     

Flag	Coverage Δ
php-8.1	80.50% <63.41%> (-0.90%)	⬇️
php-8.2	80.57% <63.41%> (-0.90%)	⬇️
php-8.3	88.99% <63.41%> (-0.95%)	⬇️
php-8.4	88.99% <63.41%> (-0.95%)	⬇️
php-8.5	88.87% <63.41%> (-0.95%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.