feat/openssl encrypt decrypt

[nahime0]

Summary

Adds OpenSSL-compatible symmetric encryption on both the AOT and eval() (magician) paths:

• openssl_encrypt(), openssl_decrypt(), openssl_cipher_iv_length(), openssl_get_cipher_methods()
• Constants: OPENSSL_RAW_DATA, OPENSSL_ZERO_PADDING, OPENSSL_DONT_ZERO_PAD_KEY
• Pure-Rust, pay-for-use implementation in elephc-crypto (no system OpenSSL / libcrypto)

Cipher matrix

AES-128/192/256 × CBC, CTR, ECB, GCM (exactly what openssl_get_cipher_methods() returns — 12 methods).

Behavior

• Raw vs Base64 via OPENSSL_RAW_DATA (Base64 handled in PHP glue; bridge is always raw)
• PHP-compatible key zero-pad/truncate and CBC/CTR IV pad/truncate
• OPENSSL_ZERO_PADDING / OPENSSL_DONT_ZERO_PAD_KEY
• GCM: AAD, by-ref $tag on encrypt, by-value tag on decrypt, tag_length 1–16
• Failures return false (warning text from stock PHP is not yet reproduced)

Architecture

PHP call
  ├─ AOT:  builtin! → RuntimeFnId → __rt_openssl_* → elephc_crypto_*
  └─ eval: eval_builtin! → same elephc_crypto_* ABI

Shared bridge keeps AOT and magician from diverging. Bridge links only when crypto builtins are used.

Docs / example

• examples/openssl_crypt/ — CBC + GCM round trips
• User docs in docs/php/strings.md + generated builtin pages
• CHANGELOG.md under [Unreleased]

Test plan

• cargo build
• cargo test -p elephc-crypto (hash vectors + OpenSSL PHP goldens / ABI)
• cargo test --test codegen_tests openssl (non-AEAD + GCM AOT)
• cargo test -p elephc-magician openssl
• cargo test --test builtin_parity_tests
• Example: cargo run -- examples/openssl_crypt/main.php && ./examples/openssl_crypt/main
• Builtin docs audit (audit_builtins.py / validate_site_compat.py)
• CI full matrix (macos-aarch64, linux-aarch64, linux-x86_64)

Notes

• Implementation plan: .plans/openssl-encrypt-decrypt.md
• PHP goldens baselined against PHP 8.4 / OpenSSL 3.6 fixtures under crates/elephc-crypto/tests/fixtures/

[greptile-apps]

Too many files changed for review (618 files, 100 file limit).