AppleStorageKeyProvider

A StorageKeyProvider that keeps the storage key in the Apple Keychain (docs/storage-key-providers.md).

One generic password item per key: service dev.kreienbuehl.ksecuremessage.storage.<namespace>, account v1/<key ID>, data = the 32 raw key bytes. Items are in the data protection keychain, accessible after the first unlock, this device only, never synchronized. This is Keychain protection, not the Secure Enclave.

namespace separates the keys of different databases, accounts or profiles of one application (letters, digits, ., _, -; at most 64). accessGroup is the keychain access group for sharing the key with app extensions, or null for the application's default group.

During a storage key rotation (docs/storage-key-rotation.md) there is one item per key ID under the same service; createKey adds an item and never updates one, removeKey deletes exactly one account's item.

A lost key is never replaced: key returns null, and an encrypted database fails to open.