security(crypto): make content-encryption keys non-extractable by default (#1691)

[wolfyres]

Description

Fixes #1691

This PR updates content key generation in src/services/crypto/content-key.ts to default to extractable: false. This ensures raw key material cannot be accidentally exposed or exported outside the crypto wrapping boundary.

Changes Introduced

• Updated generateContentKey() options so extractable defaults to false.
• Isolated any required key operations inside src/services/crypto/ wrapping boundaries.
• Added unit tests in src/services/crypto/__tests__/content-key.test.ts asserting:
  • Key extractable property is false by default.
  • Attempting crypto.subtle.exportKey('raw', key) rejects as expected.
  • Encryption and decryption operate normally with non-extractable keys.

Checklist

• Content keys are non-extractable outside the wrapping boundary (extractable === false).
• Public functions do not expose raw key material or unnecessary CryptoKey instances.
• Changes are strictly confined to src/services/crypto/.
• All unit tests pass locally.

Verification / Testing

Run crypto unit tests:

npm test src/services/crypto

[wolfyres]

CI issue has been fixed