Implement SecurityTier enum and PBKDF2 key derivation in crypto module

[ropeadope62]

Implements part of #1 (configurable security tiers)

Changes to crypto.py

• Add SecurityTier enum with values: standard, enhanced, max

• Add iteration counts per tier (0, 100k, 600k)

• Modify ZeroEnvCrypto.init to accept tier and salt parameters

• Add _derive_key() method using cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC

• Add generate_salt() static method (128-bit random salt)

• Add salt_to_string() and string_to_salt() conversion methods

Add Testing

1. Standard tier uses key directly (no derivation)
2. Enhanced/paranoid tiers derive key with correct iteration count
3. Salt is required for non-standard tiers
4. Derived keys produce valid encryption/decryption

[ropeadope62]

Implemented