feat(storage): encrypt chat history + mesh contacts at rest, atomic writes, persist contacts (#12)

User: chat history (messages + mesh/Tor contacts) must persist and be
secure/encrypted per best practice. Root cause of the .198 loss was the B17
mount race writing empty stores over real data (B17 already fixes the trigger);
this hardens storage so it can never silently lose or expose data:

- storage_crypto: shared at-rest envelope mirroring credentials::store — key =
  SHA-256(domain ‖ node identity key) (seed-derived, per-store domain
  separation), ChaCha20-Poly1305 AEAD with a random 96-bit nonce, tamper-evident.
  Transparent migration of legacy plaintext files. Unit-tested (round-trip,
  wrong-key/tamper rejection, plaintext detection).
- messages.json: encrypted at rest + ATOMIC write (temp+rename) so a crash/
  reboot mid-write cannot corrupt history; decrypt-with-migration on load; a
  failed decrypt never overwrites the on-disk data.
- mesh contacts (alias/notes/pinned/blocked): were ONLY in memory and lost on
  every restart — now persisted to mesh-contacts.json (encrypted, atomic),
  loaded on MeshState startup, saved after contacts-save/contacts-block.

Explicit clear (mesh.clear-all) still wipes everything, as intended.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/archipelago/src/node_message.rs

@@ -43,18 +43,68 @@ fn data_path() -> &'static Mutex<Option<PathBuf>> {
     PATH.get_or_init(|| Mutex::new(None))
 }
 
+/// At-rest encryption key for messages.json, derived from the node identity in
+/// `init()`. `None` only if the node key is unreadable (pre-onboarding) — in
+/// which case we persist plaintext rather than lose messages.
+fn enc_key() -> &'static Mutex<Option<[u8; 32]>> {
+    static KEY: OnceLock<Mutex<Option<[u8; 32]>>> = OnceLock::new();
+    KEY.get_or_init(|| Mutex::new(None))
+}
+
 /// Initialize message store — load from disk. Call once at startup.
 pub async fn init(data_dir: &Path) {
     let path = data_dir.join("messages.json");
     *data_path().lock().unwrap_or_else(|e| e.into_inner()) = Some(path.clone());
 
-    if let Ok(content) = tokio::fs::read_to_string(&path).await {
-        if let Ok(loaded) = serde_json::from_str::<MessageStore>(&content) {
+    // Derive + cache the at-rest encryption key (bound to this node's identity).
+    match crate::storage_crypto::derive_key(data_dir, crate::storage_crypto::DOMAIN_MESSAGES).await
+    {
+        Ok(k) => *enc_key().lock().unwrap_or_else(|e| e.into_inner()) = Some(k),
+        Err(e) => tracing::warn!(
+            "message store: encryption key unavailable ({e}); will persist plaintext"
+        ),
+    }
+
+    let Ok(raw) = tokio::fs::read(&path).await else {
+        return; // no file yet (new node)
+    };
+    // Decrypt the on-disk blob, transparently migrating a legacy plaintext file.
+    let mut was_plaintext = false;
+    let bytes = if crate::storage_crypto::is_plaintext_json(&raw) {
+        was_plaintext = true;
+        Some(raw)
+    } else {
+        let key = *enc_key().lock().unwrap_or_else(|e| e.into_inner());
+        match key {
+            Some(k) => match crate::storage_crypto::open(&raw, &k) {
+                Ok(p) => Some(p),
+                Err(e) => {
+                    tracing::error!(
+                        "message store: decrypt failed ({e}); NOT overwriting on-disk data"
+                    );
+                    None
+                }
+            },
+            None => None,
+        }
+    };
+    if let Some(bytes) = bytes {
+        if let Ok(loaded) = serde_json::from_slice::<MessageStore>(&bytes) {
             let mut guard = store().lock().unwrap_or_else(|e| e.into_inner());
             *guard = loaded;
             tracing::info!("Loaded {} messages from disk", guard.messages.len());
         }
     }
+    // Eagerly re-write a legacy plaintext file as encrypted on first boot.
+    if was_plaintext
+        && enc_key()
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .is_some()
+    {
+        persist();
+        tracing::info!("message store: migrated plaintext messages.json to encrypted at rest");
+    }
 }
 
 /// Persist current messages to disk.
@@ -63,13 +113,28 @@ pub async fn init(data_dir: &Path) {
 fn persist() {
     let guard = store().lock().unwrap_or_else(|e| e.into_inner());
     let path_guard = data_path().lock().unwrap_or_else(|e| e.into_inner());
+    let key = *enc_key().lock().unwrap_or_else(|e| e.into_inner());
     if let Some(ref path) = *path_guard {
-        if let Ok(content) = serde_json::to_string(&*guard) {
+        if let Ok(content) = serde_json::to_vec(&*guard) {
             let path = path.clone();
             drop(path_guard);
             drop(guard);
             tokio::task::spawn(async move {
-                let _ = tokio::fs::write(&path, content).await;
+                // Encrypt at rest when the node key is available; fall back to
+                // plaintext rather than drop the write if it somehow isn't.
+                let bytes = match key {
+                    Some(k) => crate::storage_crypto::seal(&content, &k).unwrap_or(content),
+                    None => content,
+                };
+                // Atomic write: stage to a temp file then rename, so a crash or
+                // reboot mid-write can never truncate/corrupt the real history
+                // (rename is atomic on the same filesystem).
+                let tmp = path.with_extension("json.tmp");
+                if tokio::fs::write(&tmp, &bytes).await.is_ok() {
+                    let _ = tokio::fs::rename(&tmp, &path).await;
+                } else {
+                    let _ = tokio::fs::remove_file(&tmp).await;
+                }
             });
         }
     }