Crypto Guardrails — Hush Private Bookmarks

Proactive guardrail for all cryptographic code in this project. Every rule is non-negotiable. Violations are security vulnerabilities, not style issues.

Scope: All files in lib/crypto*.ts, any file importing from lib/crypto*, any code using crypto.subtle, CryptoKey, PBKDF2, AES-GCM, @scure/bip39, or handling encryption/decryption.

When to Activate