fix(security): use the configured security.encryption_key for wallet-at-rest encryption

[cypriannwokolo2-creator]

Summary

config.go:329,334 require and validate a 32-byte security.encryption_key, but it is never used. Instead wallet/service.go:505-526 encrypts the secret key with AES key = SHA256(passkeySeed) — the same secret that derives the wallet, so encryption adds nothing if the seed leaks.

Acceptance Criteria

• Encrypt wallet secret material with the configured encryption key (or a derived key from it)
• Do not derive the encryption key from the wallet seed itself
• Handle rotation and legacy-decryption path
• Crypto tests

Complexity

High — cryptography + migration of stored data.

[pauxelcreatives-bot]

@pauxelcreatives-bot has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @pauxelcreatives-bot to this issue.

[king-daveed]

@king-daveed has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

PLS ASSIGN TO ME

ℹ️ Repo Maintainers: To accept this application, review their application or assign @king-daveed to this issue.

[drips-wave]

Congratulations, @king-daveed! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @king-daveed: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊