Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.

apps/api/internal/email/crypto_test.go

@@ -0,0 +1,54 @@
+package email
+
+import "testing"
+
+func TestEncryptDecryptRoundTrip(t *testing.T) {
+	t.Setenv("APP_ENV", "development")
+	key := DeriveKey("0123456789abcdef0123456789abcdef", "")
+	enc, err := EncryptSecret(key, "re_test_secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if enc == "" || enc == "re_test_secret" {
+		t.Fatal("expected ciphertext")
+	}
+	plain, err := DecryptSecret(key, enc)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plain != "re_test_secret" {
+		t.Fatalf("got %q", plain)
+	}
+}
+
+func TestDeriveKeyHex(t *testing.T) {
+	t.Setenv("APP_ENV", "development")
+	hexKey := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	key := DeriveKey(hexKey, "fallback")
+	if len(key) != 32 {
+		t.Fatalf("len=%d", len(key))
+	}
+}
+
+func TestDecryptLegacyPlaintextRejectedInProduction(t *testing.T) {
+	t.Setenv("APP_ENV", "production")
+	key := DeriveKey("x", "y")
+	if _, err := DecryptSecret(key, "legacy-plain"); err == nil {
+		t.Fatal("expected plaintext decrypt rejected in production")
+	}
+	t.Setenv("APP_ENV", "development")
+	plain, err := DecryptSecret(key, "legacy-plain")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if plain != "legacy-plain" {
+		t.Fatalf("got %q", plain)
+	}
+}
+
+func TestDeriveKeyRejectsFallbackInProduction(t *testing.T) {
+	t.Setenv("APP_ENV", "production")
+	if key := DeriveKey("", "postgres://local"); key != nil {
+		t.Fatalf("expected nil key without explicit material in production, got len=%d", len(key))
+	}
+}