feat: add typed encrypt/decrypt for subscription metadata

[JoyAdah]

Summary

• Added SubscriptionMetadata interface with typed fields (name, price, cycle, provider)
• Implemented encryptSubscriptionMetadata(key, metadata) → { ciphertext, nonce, tag }
• Implemented decryptSubscriptionMetadata(key, encrypted) → SubscriptionMetadata
• Uses AES-256-GCM (authenticated encryption) with random 96-bit nonce per call
• JSON serialization before encryption, schema validation after decryption
• Added comprehensive tests: round-trip fidelity, tamper rejection, nonce uniqueness, wrong key rejection, all cycle types

Closes #839

Test plan

• Verify round-trip encrypt → decrypt preserves all metadata fields
• Verify tampered ciphertext is rejected (authentication tag check)
• Verify nonce is unique per encryption call
• Verify wrong key decryption is rejected
• Run npm test in shared/ to confirm all tests pass

🤖 Generated with Claude Code

[drips-wave]

@JoyAdah Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits