feat: add event codec and per-entity DEK helper

[nicolasburtey]

Summary

• add an opt-in EventPayloadCodec hook for event JSONB payloads, defaulting to plaintext JSON
• wire repo persistence, generic queries, and nested hydration through the selected codec
• add PerEntityDataKey / PerEntityDataKeyState helpers for streams that keep a wrapped per-entity DEK in mutable projection state and clear it for crypto-shredding
• add a toy encoded payload POC test that proves stored event JSONB can be opaque while hydration still works

Lana usage

• Lana PR: https://github.com/GaloyMoney/lana-bank/pull/5819
• The customer PII stream uses PerEntityDataKey for the wrapped DEK lifecycle while keeping the wrapped DEK out of immutable event payloads.

Verification

• cargo fmt --check --all
• cargo test -p es-entity --lib crypto_shred
• earlier on this branch: cargo test -p es-entity-macros
• earlier on this branch: DATABASE_URL=<dedicated es_entity_poc db> cargo check --workspace
• earlier on this branch: DATABASE_URL=<dedicated es_entity_poc db> cargo test -p es-entity

Notes

• This remains a POC branch for the payload codec. The test codec is toy XOR/hex, not production crypto.
• The per-entity DEK helper is crypto-library agnostic; applications own the actual wrapping, lookup, and erase semantics.