add optional Argon2id password wrap for zk uploads.

Wrap the image DEK for password-protected batches, keep the URL fragment as a separate secret, and extend prepare/decrypt helpers with tests.

frontend/package-lock.json

@@ -12,6 +12,7 @@
                 "@tailwindcss/vite": "^4.3.3",
                 "@uswriting/exiftool": "1.0.9",
                 "axios": "^1.20.0",
+                "hash-wasm": "^4.12.0",
                 "pinia": "^4.0.3",
                 "pretty-bytes": "^7.2.0",
                 "tailwindcss": "^4.3.3",
@@ -2513,6 +2514,12 @@
                 "url": "https://github.com/sponsors/ljharb"
             }
         },
+        "node_modules/hash-wasm": {
+            "version": "4.12.0",
+            "resolved": "https://registry.npmjs.org/hash-wasm/-/hash-wasm-4.12.0.tgz",
+            "integrity": "sha512-+/2B2rYLb48I/evdOIhP+K/DD2ca2fgBjp6O+GBEnCDk2e4rpeXIK8GvIyRPjTezgmWn9gmKwkQjjx6BtqDHVQ==",
+            "license": "MIT"
+        },
         "node_modules/hasown": {
             "version": "2.0.4",
             "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",