Define kms.Provider so the cipher service can swap between AWS KMS and
a self-hostable local-key path. Local impl uses AES-256-GCM with the
master key sourced from KMS_LOCAL_MASTER_KEY (base64) or KMS_LOCAL_MASTER_KEY_FILE.
Factory FromEnv selects at boot via KMS_PROVIDER; defaults to aws for
backwards compatibility.
Ciphertext blob format is opaque: switching providers requires a DEK
migration because each provider can only decrypt its own blobs.
10 tests cover round-trip, tamper detection, nil-key rejection, and
factory env-selection paths.
Matthew Meszaros