Support DEK rotation on empty storage

[harrytmthy]

Background

SafeBox currently uses a static DEK per file, which remains unchanged for its lifetime. Although the key is securely stored and masked, a long-lived DEK increases exposure to eventual cryptanalysis. DEK rotation is not yet supported due to potential data invalidation risks.

Goal

Enable DEK rotation without introducing dead entries.

Proposal

A configurable DEK rotation policy will be introduced:

• NEVER: SafeBox will never rotate DEK (default, fastest)
• ON_EMPTY: SafeBox will rotate DEK when storage becomes empty via clear() or last remove() (safest)

DEK rotation will be gated inside the writeMutex. To prevent dead entries, DEK rotation will only be done when no live entries exist.