[CRITICAL] Remove hardcoded encryption fallback key from EncryptionService

[kilodesodiq-arch]

Engineering Gap

EncryptionService at app/backend/src/common/encryption/encryption.service.ts silently falls back to a publicly visible hardcoded string when the ENCRYPTION_MASTER_KEY environment variable is not configured. The fallback is at line 22: const keyMaterial = masterKey ?? 'insecure-default-change-in-production!!!!!';. Only a Logger.warn at line 19 defends against this. Every consumer including ClaimsService (encrypts recipientRef at claims.service.ts line 97) uses keys derived from this public fallback in production misconfiguration scenarios.

---

Codebase Evidence

• app/backend/src/common/encryption/encryption.service.ts lines 17-22: Constructor reads ENCRYPTION_MASTER_KEY from ConfigService, logs warning, falls back to hardcoded string
• app/backend/src/claims/claims.service.ts line 97: recipientRef encrypted with service — PII compromised if fallback active
• app/ai-service/config.py lines 95-99: AI service validates API keys in production and raises ValueError — the required pattern

---

Risk Profile

Current Risk

If ENCRYPTION_MASTER_KEY is omitted, all encrypted data uses a key visible in public source code.

Failure Scenario

Production misses ENCRYPTION_MASTER_KEY. Warning goes unnoticed. Thousands of recipient identities encrypted with known key. Database backup exposed — attacker with source code decrypts all PII.

Business Impact

Complete PII compromise. Humanitarian data protection violation. Trust destroyed.

---

Remediation Strategy

Remove fallback entirely. In production/staging, throw fatal Error. Only allow fallback in dev/test with [INSECURE-DEV] prefix. Follow app/ai-service/config.py validator pattern.

---

Success Conditions

• Hardcoded fallback removed from non-dev paths
• Fatal error at startup in production without ENCRYPTION_MASTER_KEY
• Unit tests updated with explicit ENCRYPTION_MASTER_KEY
• .env.example includes ENCRYPTION_MASTER_KEY with generation guide
• Existing test suite passes

---

Change Surface

Files Likely Impacted

• app/backend/src/common/encryption/encryption.service.ts
• app/backend/src/common/encryption/encryption.service.spec.ts
• app/backend/.env.example

Components Affected

• EncryptionService, ClaimsService, EvidenceService

---

Verification Plan

Test constructor throws in production without key. Test round-trip with valid key.

---

Security Review

Direct cryptographic key management vulnerability. Fallback key in public source code. Database breach + source access = full PII compromise.

---

Completion Checklist

• Implementation completed
• Peer reviewed
• Tests passing
• Security review completed
• Ready for merge