Close two defense-in-depth gaps surfaced by the v3.8.1 release vulnerability scan:
- Field-level credential encryption (src/lib/db/encryption.ts) and the CLI
decrypt path (bin/cli/encryption.mjs) now pass authTagLength: 16 to every
createDecipheriv call. Authentication was already enforced via setAuthTag +
final(), but pinning the tag length rejects truncated GCM tags up front,
closing the tag-truncation forgery vector (Semgrep gcm-no-tag-length).
- MermaidDiagram switches securityLevel from "loose" to "strict" (Mermaid's
default), so the rendered SVG is sanitized by Mermaid's bundled DOMPurify
before the innerHTML assignment.
Adds a regression test asserting decrypt() fails closed on a truncated auth tag.
