feat: Phase 2 Security Enhancement

- pkg/crypto: AES-256-GCM encryption with PBKDF2 key derivation
  - 100k iterations, 16-byte salt, SHA-256
  - Encrypt/Decrypt/IsEncrypted/HashPassword
- Storage layer encryption:
  - JSONStorage.SetPassword() enables transparent encrypt/decrypt
  - readJSON auto-decrypts, replace* auto-encrypts
- pkg/knownhosts: TOFU host key verification
  - Verify/Add/Remove host keys
  - HostKeyCallback for SSH config
- SSH client security:
  - SetHostKeyCallback() replaces InsecureIgnoreHostKey()
  - SetPassphraseCallback() for encrypted private keys
  - getKeySigner() tries passphrase on encrypted keys
- Models: AppConfig gains EncryptionEnabled, PasswordHash, KnownHostsFile

pkg/storage/json_storage.go

@@ -12,12 +12,14 @@ import (
 	"github.com/google/uuid"
 
 	"git.tukangketik.id/swanadiva/hostkeeper/internal/models"
+	"git.tukangketik.id/swanadiva/hostkeeper/pkg/crypto"
 )
 
 // JSONStorage implements Storage interface using JSON files
 type JSONStorage struct {
-	dataDir string
-	mu      sync.RWMutex
+	dataDir  string
+	password string // master password for encryption (empty = no encryption)
+	mu       sync.RWMutex
 }
 
 // NewJSONStorage creates a new JSON storage instance
@@ -35,6 +37,21 @@ func NewJSONStorage(dataDir string) (*JSONStorage, error) {
 	return s, nil
 }
 
+// SetPassword sets the master password for encryption/decryption
+func (s *JSONStorage) SetPassword(password string) {
+	s.password = password
+}
+
+// GetPassword returns the current master password
+func (s *JSONStorage) GetPassword() string {
+	return s.password
+}
+
+// IsEncrypted returns whether encryption is enabled
+func (s *JSONStorage) IsEncrypted() bool {
+	return s.password != ""
+}
+
 func (s *JSONStorage) ensureDataFiles() error {
 	files := map[string]string{
 		"hosts.json":    "hosts",
@@ -162,6 +179,15 @@ func (s *JSONStorage) replaceHosts(hosts []*models.Host) error {
 		return fmt.Errorf("failed to marshal hosts: %w", err)
 	}
 
+	// Encrypt if password is set
+	if s.password != "" {
+		encrypted, err := crypto.Encrypt(bytes, s.password)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt hosts: %w", err)
+		}
+		bytes = []byte(encrypted)
+	}
+
 	return os.WriteFile(s.getHostsPath(), bytes, 0600)
 }
 
@@ -272,6 +298,15 @@ func (s *JSONStorage) replaceKeyPairs(keys []*models.KeyPair) error {
 		return fmt.Errorf("failed to marshal key pairs: %w", err)
 	}
 
+	// Encrypt if password is set
+	if s.password != "" {
+		encrypted, err := crypto.Encrypt(bytes, s.password)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt key pairs: %w", err)
+		}
+		bytes = []byte(encrypted)
+	}
+
 	return os.WriteFile(s.getKeysPath(), bytes, 0600)
 }
 
@@ -382,6 +417,15 @@ func (s *JSONStorage) replaceSnippets(snippets []*models.Snippet) error {
 		return fmt.Errorf("failed to marshal snippets: %w", err)
 	}
 
+	// Encrypt if password is set
+	if s.password != "" {
+		encrypted, err := crypto.Encrypt(bytes, s.password)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt snippets: %w", err)
+		}
+		bytes = []byte(encrypted)
+	}
+
 	return os.WriteFile(s.getSnippetsPath(), bytes, 0600)
 }
 
@@ -508,5 +552,15 @@ func (s *JSONStorage) readJSON(path string, v interface{}) error {
 	if err != nil {
 		return err
 	}
+
+	// Decrypt if password is set and data looks encrypted
+	if s.password != "" && crypto.IsEncrypted(string(data)) {
+		decrypted, err := crypto.Decrypt(string(data), s.password)
+		if err != nil {
+			return fmt.Errorf("decryption failed: %w", err)
+		}
+		data = decrypted
+	}
+
 	return json.Unmarshal(data, v)
 }