Create crypto.ts with Web Crypto API utilities: PBKDF2 key derivation (100K iterations, SHA-256), AES-256-GCM encrypt/decrypt, session key management. Modify idb-storage.ts to transparently encrypt/decrypt conversations when a session key is set. Disabled in dev mode via VITE_DISABLE_CRYPTO=true. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>