feat(storage): encrypted areas layer (home, system, data/<id>) over any FS; locked until key; plaintext refused; tamper/truncation detected; tests on memory + real ext4

crates/servers/storage-server/src/filesystem.rs

@@ -78,6 +78,9 @@ pub trait FileSystem {
     fn seek(&mut self, handle: FileHandle, offset: usize) -> bool;
     /// Removes the directory at `path`, which must be empty.
     fn rmdir(&mut self, path: &[u8]) -> bool;
+    /// The master key and a fresh random seed, once the owner is in; only
+    /// an encrypting file system has a use for them.
+    fn unlock(&mut self, _master: &[u8; 32], _seed: &[u8; 32]) {}
     /// Whether anything can be written at all; the server refuses
     /// writing requests up front when not.
     fn writable(&self) -> bool {