Add encrypted pathway payload envelopes

[jbiskur]

Summary

• add symmetric whole-payload encryption for pathways marked encrypted
• use Flowcore-compatible { encryptedPayload } envelope plus metadata markers
• decrypt marked events before schema validation, handlers, subscribers, and routing

Why

Flowcore ingest and event-source APIs require event payloads to be objects, so encrypted payloads need an object envelope instead of a raw string body.

Validation

• deno fmt --check src/pathways/encryption.ts src/pathways/types.ts src/pathways/builder.ts tests/pathway-encryption.test.ts
• deno check src/mod.ts tests/pathway-encryption.test.ts
• deno lint
• deno test -A tests/pathway-encryption.test.ts
• deno test -A tests/postgres-pathway-state.test.ts tests/postgres-pump-state.test.ts with repo Postgres helper

Full deno test -A was also attempted. It is blocked locally by a pre-existing listener on port 3001 used by tests/server.test.ts.