fn derive_key(passphrase: &str, salt: &[u8; 32]) -> [u8; 32]
Derive a 32-byte AES-256-GCM key from passphrase using Argon2id.
passphrase