The build service's context dropped new files added under app/ (keycrypto.py never reached the image while main.py did), causing a crash loop. Inline the module so the deploy cannot miss it. Behavior unchanged: AES-256-GCM at rest, KEK from PORTAL_KEK, enc1: format, legacy plaintext passthrough, fail-closed migration.