fix(H6): authenticated-encrypted backups (AES-GCM + PBKDF2)

[d33mobile]

Finding (ISSUES.md H6 — Backups are neither encrypted nor authenticated; CRC-32 is not a MAC)

storage/backup.h, storage/backup.c, serial/commands_backup.c. The blob is plaintext backup_key_t records — secret[20] is the raw HMAC-SHA1 seed — protected only by a CRC any attacker can recompute.

1. Confidentiality. cmd_export_keys prints every seed for every key. Anyone obtaining a blob derives valid codes for every key including admin keys, indefinitely.
2. Integrity. An attacker who gets a blob accepted sets is_admin = 1 on a record whose secret they chose, fixes the CRC, and gains permanent admin. backup_import applies no privilege check on is_admin — import is the only way to set that bit without set-key-admin.

• Encrypt-then-MAC the payload (PBKDF2/HKDF + AES-GCM or ChaCha20-Poly1305 via the already-linked mbedTLS); reject on MAC failure before any parsing. Keep the CRC only as a paste-corruption hint.
• At minimum, refuse to import is_admin = 1 records without per-key operator re-confirmation.

Fix

A backup's whole purpose is to live off-device, so its raw seeds must be useless to anyone who obtains the blob, and a tampered blob must never be trusted. The payload is now encrypted-then-MAC'd under an operator passphrase (a backup is portable, so the key cannot be device-bound — device-bound at-rest secrecy is H7's concern).

New wire format v2

Cleartext header followed by AES-256-GCM ciphertext of the serialised records:

field	size	notes
magic	4	HSLL
version	4	2
key_count	4	authenticated (AAD)
salt	16	PBKDF2 salt, authenticated (AAD)
iv	12	GCM nonce, authenticated (AAD)
tag	16	GCM auth tag = the MAC
checksum	4	CRC-32 of ciphertext — paste-corruption hint only, not a trust boundary
ciphertext	key_count * sizeof(backup_key_t)	AES-256-GCM of the key records

Crypto

• Key derivation: mbedtls_pkcs5_pbkdf2_hmac_ext(MBEDTLS_MD_SHA256, passphrase, salt, 100000 iters) → 32-byte key.
• AEAD: AES-256-GCM (mbedtls_gcm_crypt_and_tag / mbedtls_gcm_auth_decrypt). The header prefix through the IV is passed as associated data, so magic/version/key_count/salt/iv are authenticated. With GCM the tag is the MAC of ciphertext + AAD — encrypt-then-MAC by construction.
• backup_export takes the passphrase, derives the key, encrypts, emits the v2 blob (salt/IV from the platform CSPRNG, get_rand_64). backup_import parses the cleartext header, derives the key from the blob's salt, GCM-verifies the tag, and rejects before parsing any record on failure. Wrong passphrase and any tamper (header / ciphertext / tag) all fail the tag check.
• The CRC is retained only to hint at paste corruption; the GCM tag is the sole trust boundary.

is_admin backstop (defense-in-depth)

Even with a valid MAC, each is_admin record is gated through a per-key operator confirmation callback (backup_admin_confirm_fn) before any destructive write; a denied record aborts the whole import with existing keys untouched. A NULL callback denies all admin records. commands_backup.c prompts for the passphrase over the console (export + import) and drives the admin-confirm prompt.

mbedtls config

mbedtls_config.h enables MBEDTLS_AES_C, MBEDTLS_CIPHER_C, MBEDTLS_GCM_C, MBEDTLS_PKCS5_C (previously only MD/SHA-1/SHA-256). mbedtls_pkcs5_pbkdf2_hmac_ext is a mbedTLS 3.x API — matches pico-sdk master (docs/BUILD.md). verify-on-hw: firmware image-size impact of the added mbedtls modules, on-device PBKDF2 timing (100k iters, HW-accelerated SHA-256 when LIB_PICO_SHA256), and the console passphrase-entry UX.

Host-side verification

test/harness_storage.c links the real first-party backup.c + storage.c + littlefs against system mbedTLS and tests the round-trip end to end:

• export → import round-trip with the right passphrase restores every key (including an admin key via the confirm callback);
• the ciphertext contains no cleartext seed (searches for the raw seed bytes);
• wrong passphrase → rejected, store untouched;
• tampered GCM tag (CRC still valid) → MAC failure → rejected;
• tampered ciphertext → MAC failure → rejected;
• tampered AAD (key_count altered within range) → MAC failure → rejected;
• malformed headers (bad magic/version, over-large key_count, truncated, too-small) → rejected pre-decrypt;
• is_admin backstop: a validly-encrypted forged admin record is rejected when the operator declines and when the callback is NULL, and imported only when confirmed — directly exercising the H6 escalation path;
• UBSan regression: a forged valid blob with a non-bool flag byte imports and reads back canonicalised.

The test forges validly-authenticated blobs with the same PBKDF2+GCM construction (the "passphrase holder crafts a malicious payload" model), so the is_admin / non-bool paths are exercised through genuine ciphertext, not plaintext pokes.

CI host gates all green locally: make -C test asan = 0, valgrind = 0, coverage = 0, ./ci --action=check = 0. The libFuzzer fuzz_*.c harnesses are out of scope (clang-only, not in CI) and untouched.

Scoped to follow-up

• Import atomicity (stage to a temp key set, swap only on full success) is M6, not changed here — backup_import still deletes-then-writes, but the admin backstop runs before any delete.
• Removing the pre-input safety-backup double-emit is M15; this PR emits the safety backup once (after the passphrase prompt, before overwrite).
• base64_decode bounds hardening is M5; buffer sizes here are derived from sizeof(backup_header_t)/record counts and track the larger v2 header correctly.