Add AWS KMS BYOK support

[techulus-agent]

Summary

• add optional AWS KMS wrapping for the existing AES-256-GCM data encryption key
• support fresh KMS bootstrap and safe migration from ENCRYPTION_KEY without rewriting secrets or changing the agent wire format
• persist only the versioned wrapped DEK in the existing PostgreSQL settings table
• add conflict-safe multi-replica initialization, per-process caching, retry after KMS failures, and strict configuration validation
• resolve the DEK before agent registration and atomically consume registration tokens
• add role-based installer configuration, environment examples, and BYOK operational documentation
• document direct cross-account grants for a Techulus-account control plane using a customer-account KMS key

Safety properties

• local encryption remains the default and retains the existing ciphertext format
• existing encryption state cannot silently bootstrap a different DEK without the previous local key
• configured raw and wrapped keys must match during migration
• KMS ARN mismatch, disabled/invalid keys, corrupt wrapped blobs, and unavailable KMS access fail closed
• KMS errors return 503 for secret reveal and agent registration without consuming the registration token

Testing

• pnpm test — 264 tests passed
• pnpm exec tsc --noEmit
• pnpm exec biome check ... on changed TypeScript files
• bash -n deployment/install.sh
• git diff --check

Basecamp: https://app.basecamp.com/5890597/buckets/47439993/todos/10114307679

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
techulus-cloud	🟢 Ready	View Preview	Jul 21, 2026, 7:43 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[github-actions]

React Doctor found no issues. 🎉

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against main to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on main.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit b4a480c.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
techulus-cloud	🟡 Building	–	Jul 21, 2026, 7:42 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.