Add module-level documentation explaining that the salt field is reserved for Phase B KDF-based key rotation. Add doc comment on the salt field clarifying it is not used in v1 key derivation. Add TODO(Phase B) comment on salt generation in encrypt().