feat(12-02): implement Argon2id KDF, rpassword prompt, and salt format support

- Add argon2 0.5 and rpassword 7.4 dependencies
- Implement derive_key_from_password() using Argon2id with 16-byte salt
- Implement prompt_password() with optional confirmation for pack
- Add resolve_key_for_pack() (generates random salt) and resolve_key_for_unpack() (reads salt from archive)
- Add FLAG_KDF_SALT (bit 4), SALT_SIZE constant, read_salt/write_salt functions to format.rs
- Relax flags validation to allow bit 4 (bits 5-7 must be zero)

Cargo.toml

@@ -14,6 +14,8 @@ rand = "0.9"
 rayon = "1.11"
 anyhow = "1.0"
 hex = "0.4"
+argon2 = "0.5"
+rpassword = "7.4"
 
 [dev-dependencies]
 tempfile = "3.16"