Create client-side encrypted claim packages without backend plaintext. - [ ] AES-GCM envelope - [ ] Fragment-key claim link - [ ] Ciphertext-only storage - [ ] Admin recovery bundle - [ ] Local recipient decryption - [ ] Wrong-key and tamper tests Exit criterion: stored ciphertext reveals no payroll row and only the fragment key decrypts it.
Create client-side encrypted claim packages without backend plaintext.
Exit criterion: stored ciphertext reveals no payroll row and only the fragment key decrypts it.