Implement decryption logic and integrity verification

Use Dart's pointycastle library for AES-GCM (GCMBlockCipher) and the crypto package for HMAC-SHA256. Store IV (12 bytes), ciphertext, and HMAC tag as separate base64 fields in the EncryptedFieldBlob model — do not concatenate them into a single opaque blob as this makes debugging impossible. Run decryption in a Dart compute() isolate to prevent UI jank on older devices; pass only serialisable data (base64 strings) across the isolate boundary — never pass key objects. Model the result as a sealed class hierarchy (DecryptionSuccess / DecryptionError) using Dart 3 sealed classes; this forces callers to handle the error case at compile time.

The HMAC check must run after decryption, not before — AES-GCM provides authenticated encryption natively, but the additional HMAC provides a secondary, independently auditable integrity layer as required for sensitive personal data (GDPR article 32). Never log the org key or plaintext — use structured logging with a sanitise() helper that redacts known secret field names.

Write unit tests using flutter_test covering: (1) successful AES-GCM decryption returns correct plaintext, (2) HMAC mismatch returns DecryptionError with INTEGRITY_VIOLATION, (3) corrupt ciphertext returns DecryptionError with DECRYPTION_FAILED, (4) null/empty input returns INVALID_INPUT without throwing, (5) unavailable org key returns KEY_UNAVAILABLE. Use known test vectors for AES-GCM to validate correctness. Mock the key store to return controlled keys. Verify no plaintext leaks into the DecryptionError fields.

Achieve 100% branch coverage on the result type handling. Integration test: encrypt a real contact field, persist to Supabase, fetch back, decrypt — assert round-trip fidelity.