Add AEAD context binding to server island encryption

[matthewp]

Changes

• Server island encrypted parameters (e, p, s) are now bound to their target component and purpose using AES-GCM authenticated additional data (AAD). Each ciphertext includes context like props:Island or slots:CommentsSection so that encrypted data for one component cannot be replayed against a different component, and encrypted props cannot be reused as slots.
• encryptString and decryptString in encryption.ts accept an optional additionalData string parameter, passed through to the Web Crypto AesGcmParams. Both the encryption side (server-islands.ts) and decryption side (endpoint.ts) now pass matching AAD values.

Testing

• New unit test throws when decrypting with mismatched additionalData verifies that cross-component/cross-parameter replay is rejected at the crypto layer.
• All existing server island tests updated to encrypt with proper AAD. All 45 tests pass (24 server-islands, 5 CSP, 16 encryption unit).

Docs

• No docs update needed; this is an internal encryption hardening with no user-facing API change.

[changeset-bot]

🦋 Changeset detected

Latest commit: 165d38f

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 18 untouched benchmarks

---

_{Comparing server-island-encryption-aad (20efd59) with main (b2d8eb3)¹}

Footnotes

1. No successful run was found on main (b073bad) during the generation of this report, so b2d8eb3 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[ematipico]

I suggest reviewing what your agent writes in the PR description, because I honestly have no idea what we're fixing based on what it wrote (very technical terms, and it assumes reviewers know the very technical details of the bug/solution).

Approving, but with an asterisk

[matthewp]

@ematipico I wrote the description here. How can I write it better? It is technical, but that's necessary for a PR review. I guess I could have added a link about AAD, which is something I wasn't familiar with before starting on the change. That's here: https://en.wikipedia.org/wiki/Authenticated_encryption