feat: Per-Mandant-Crypto-Shredding (A3) — ScopedCryptoProvider (v0.6.0)
CryptoContext + optionale context-Varianten (Default-Extension → bestehende
Provider unverändert); ScopeVaultClient; ScopedCryptoProvider (Actor,
scopeResolver, Sub-Key-Cache, Master-Fallback, shredded→wirft);
createScopedKeyProviderFromVault; EventSyncConfig.scopeResolver → Engine baut
Scoped-Provider, Context an emit/pull/reencrypt. AES-GCM-seal/open geteilt.
31 Tests grün, abwärtskompatibel. Parität zu @mana/event-sync 0.7.0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
bfc1ea5310