chore: Drop archived 'encrypt' dep, use pointycastle directly

[MohamedGawdat]

Closes #91.

Why

flagsmith ^6.1.0 depends on encrypt ^5.0.3, which pins pointycastle ^3.7.3. This blocks downstream apps that depend on pointycastle ^4.0.0:

flagsmith ^6.1.0 -> encrypt ^5.0.3 -> pointycastle ^3.7.3
my app                              -> pointycastle ^4.0.0  ❌

Bumping encrypt is not an option — leocavalcante/encrypt is archived (read-only), and PR encrypt#343 (which would have widened its pointycastle constraint) has been open and unreviewed since Feb 2025. encrypt 5.0.4 will remain the final release, permanently locking it to pointycastle ^3.7.3.

What

StorageSecurity (the only consumer of encrypt in this codebase) used encrypt as a thin wrapper around PointyCastle's Salsa20Engine. This PR calls Salsa20Engine directly:

• Same algorithm (Salsa20)
• Same key derivation (MD5 of password, 16 bytes)
• Same 8-byte random IV
• Same on-disk format: base64(iv) || base64(ciphertext)

Fully backwards-compatible with existing encrypted storage — values written by previous versions decrypt identically.

Diff

# pubspec.yaml
-  encrypt: ^5.0.3
+  pointycastle: ^4.0.0

# lib/src/core/tools/security.dart
-import 'package:encrypt/encrypt.dart';
+import 'package:pointycastle/export.dart';

-late Encrypter _enc;
-StorageSecurity(this.password) {
-  _encryptedPassword = _generateEncryptPassword(password!);
-  _enc = Encrypter(Salsa20(Key(_encryptedPassword)));
-}
+StorageSecurity(this.password) {
+  _encryptedPassword = _generateEncryptPassword(password!);
+}
+
+Uint8List _process(Uint8List input, Uint8List iv) {
+  final engine = Salsa20Engine()
+    ..init(true, ParametersWithIV(KeyParameter(_encryptedPassword), iv));
+  return engine.process(input);
+}

(encrypt/decrypt methods updated to call _process directly with utf8/base64 conversion — same I/O contract.)

Net dependency change

	Before	After
Direct deps	encrypt, crypto	pointycastle, crypto
Transitive pointycastle	yes (via encrypt)	yes (direct)

No new transitive packages added.

[MohamedGawdat]

@rolodato when you have a moment — this PR removes the dependency on the archived encrypt package, which permanently blocks downstream apps from adopting pointycastle ^4.0.0. The on-disk encrypted-storage format is unchanged (backwards-compatible) and all 122 existing tests pass. Happy to address any feedback.