Enforce minimum salt length for PBKDF2 key derivation

[mancej]

Summary

• Adds a minimum salt length validation (16 bytes, per NIST SP 800-132) to both New and NewWithPasswordNonce constructors in the encryption package
• Short or predictable salts weaken PBKDF2 by allowing attackers to precompute derived keys across targets. Without validation, callers could pass nil, empty, or trivially short salts (the existing tests used []byte("salt") — only 4 bytes)
• Exports MinSaltLength constant so consumers can reference the requirement programmatically
• Updates all existing tests to use compliant 16+ byte salts and adds two new tests that verify short salts are rejected

Changes

File	Change
encryption/encryptor_decryptor.go	Added MinSaltLength const, validateSalt() helper, and validation calls in both constructors
encryption/encryptor_decryptor_test.go	Updated test salts to 16+ bytes; added TestNew_RejectsShortSalt and TestNewWithPasswordNonce_RejectsShortSalt
cache/encrypted_cache_test.go	Updated test salt constant to 16+ bytes

Breaking change

Callers passing salts shorter than 16 bytes will now receive an error. This is intentional — those salts were insecure.

Test plan

• All existing encryption and cache tests pass with updated salts
• New tests verify both constructors reject salts < 16 bytes
• go build ./... compiles cleanly

[Copilot]

Pull request overview

This PR strengthens the encryption package’s PBKDF2 usage by enforcing a minimum salt length (16 bytes) in constructors, and updates downstream tests/call sites to comply with the new requirement.

Changes:

• Added MinSaltLength and a validateSalt() helper, and invoked validation from New and NewWithPasswordNonce.
• Updated encryption tests to use 16+ byte salts and added new tests asserting short salts are rejected.
• Updated encrypted cache tests to use a compliant salt.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.

File	Description
encryption/encryptor_decryptor.go	Enforces minimum salt length via shared validation in both constructors.
encryption/encryptor_decryptor_test.go	Updates salts to comply and adds coverage for short-salt rejection.
cache/encrypted_cache_test.go	Updates test salt constant to meet the new minimum.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.