fix: bind EXPORT_VERSION to HKDF info string in key backup (v3.1)

[Copilot]

Using a static HKDF info string means a future version bump with a different cipher scheme would derive the same key from the same password+salt — enabling key reuse across incompatible formats.

Changes

• EXPORT_VERSION bumped 3.0 → 3.1 to mark the boundary where version-binding takes effect
• Export: info string now includes the version:

  // before
  HKDF.derive(passwordKey, hkdfSalt, 'QryptChat-KeyBackup-ChaCha20', 32)
  // after
  HKDF.derive(passwordKey, hkdfSalt, `QryptChat-KeyBackup-v${EXPORT_VERSION}-ChaCha20`, 32)

• Import: version-aware info string selection preserves backward compatibility with existing v3.0 backups:

  const hkdfInfo = parsedData.version === '3.0'
      ? 'QryptChat-KeyBackup-ChaCha20'
      : `QryptChat-KeyBackup-v${parsedData.version}-ChaCha20`;

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.