docs(lib): propagate errors in the encryption quick start (LAB-8004)

The crate-level encryption example unwrapped every fallible call, so a short key from a secret manager panicked. It now runs in a Result-returning main and uses ?, matching the README quick start.

Author: 27Bslash6

src/lib.rs

@@ -42,19 +42,23 @@
 //! use cachekit_core::{ZeroKnowledgeEncryptor, derive_domain_key};
 //! use zeroize::Zeroizing; // add the zeroize crate to your Cargo.toml
 //!
-//! // Derive tenant-isolated key
-//! // From your secret manager or CACHEKIT_MASTER_KEY, hex-decoded to 32 raw bytes.
-//! // Never hard-code it, and never pass the hex string's bytes.
-//! // Zeroizing wipes each key from memory when it is dropped.
-//! let master_key = Zeroizing::new(load_master_key_from_secret_manager());
-//! let tenant_key = Zeroizing::new(derive_domain_key(master_key.as_slice(), "cache", b"tenant-123").unwrap());
-//!
-//! // Encrypt
-//! let encryptor = ZeroKnowledgeEncryptor::new().unwrap();
-//! let ciphertext = encryptor.encrypt_aes_gcm(b"secret", tenant_key.as_slice(), b"tenant-123").unwrap();
-//!
-//! // Decrypt
-//! let plaintext = encryptor.decrypt_aes_gcm(&ciphertext, tenant_key.as_slice(), b"tenant-123").unwrap();
+//! fn main() -> Result<(), Box<dyn std::error::Error>> {
+//!     // Derive tenant-isolated key
+//!     // From your secret manager or CACHEKIT_MASTER_KEY, hex-decoded to 32 raw bytes.
+//!     // Never hard-code it, and never pass the hex string's bytes.
+//!     // Zeroizing wipes each key from memory when it is dropped.
+//!     let master_key = Zeroizing::new(load_master_key_from_secret_manager()?);
+//!     let tenant_key = Zeroizing::new(derive_domain_key(master_key.as_slice(), "cache", b"tenant-123")?);
+//!
+//!     // Encrypt
+//!     let encryptor = ZeroKnowledgeEncryptor::new()?;
+//!     let ciphertext = encryptor.encrypt_aes_gcm(b"secret", tenant_key.as_slice(), b"tenant-123")?;
+//!
+//!     // Decrypt
+//!     let plaintext = encryptor.decrypt_aes_gcm(&ciphertext, tenant_key.as_slice(), b"tenant-123")?;
+//!     assert_eq!(plaintext, b"secret");
+//!     Ok(())
+//! }
 //! ```
 //!
 //! ## Security Properties