security(lib,storage): enforce single-use encryption contexts, encrypt keyring and harden key import

samples/src/test/java/demo/AesTest.java

@@ -44,6 +44,7 @@ import java.util.logging.Logger;
 
 import javax.crypto.SecretKey;
 
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 
 import conflux.Ctx;
@@ -62,6 +63,7 @@ import zeroecho.sdk.builders.core.PlainBytesBuilder;
 import zeroecho.sdk.content.api.DataContent;
 import zeroecho.sdk.ZeroEchoSession;
 
+@Tag("sample")
 class AesTest {
     private static final Logger LOG = Logger.getLogger(AesTest.class.getName());
     private final ZeroEchoSession zeroEchoSession = new ZeroEchoSession();

samples/src/test/java/demo/AgreementVariantsTest.java

@@ -41,6 +41,7 @@ import java.util.logging.Level;
 import java.util.logging.Logger;
 
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 
 import zeroecho.core.CryptoAlgorithm;
@@ -107,6 +108,7 @@ import zeroecho.sdk.util.BouncyCastleActivator;
  * for didactic reasons.
  * </p>
  */
+@Tag("sample")
 class AgreementVariantsTest {
     private final ZeroEchoSession session = new ZeroEchoSession();
 

samples/src/test/java/demo/CombinedDeliveryTest.java

@@ -43,6 +43,7 @@ import java.util.logging.Level;
 import java.util.logging.Logger;
 
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.TestInstance;
 
@@ -61,6 +62,7 @@ import zeroecho.sdk.Pbkdf2Limits;
 import zeroecho.sdk.ZeroEchoSession;
 import zeroecho.sdk.util.BouncyCastleActivator;
 
+@Tag("sample")
 @TestInstance(TestInstance.Lifecycle.PER_CLASS)
 class CombinedDeliveryTest {
     private static final Logger LOG = Logger.getLogger(CombinedDeliveryTest.class.getName());

samples/src/test/java/demo/HybridDerivedAesDemoTest.java

@@ -42,6 +42,7 @@ import java.util.Arrays;
 import java.util.logging.Logger;
 
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 
 import zeroecho.core.alg.kyber.KyberKeyGenSpec;
@@ -77,6 +78,7 @@ import zeroecho.sdk.util.BouncyCastleActivator;
  * HKDF salt) and injects key/IV/AAD into existing streaming builders.
  * </p>
  */
+@Tag("sample")
 class HybridDerivedAesDemoTest {
     private final ZeroEchoSession session = new ZeroEchoSession();
 

samples/src/test/java/demo/HybridKexDemoTest.java

@@ -40,6 +40,7 @@ import java.util.Arrays;
 import java.util.logging.Logger;
 
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 
 import zeroecho.core.alg.common.agreement.KeyPairKey;
@@ -102,6 +103,7 @@ import zeroecho.sdk.util.BouncyCastleActivator;
  * explicit close blocks keeps the handshake lifecycle visible to the reader.
  * </p>
  */
+@Tag("sample")
 class HybridKexDemoTest {
     private final ZeroEchoSession session = new ZeroEchoSession();
 

samples/src/test/java/demo/HybridSigningAesTest.java

@@ -46,6 +46,7 @@ import java.util.logging.Logger;
 import javax.crypto.SecretKey;
 
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 
 import zeroecho.core.alg.ed25519.Ed25519KeyGenSpec;
@@ -77,6 +78,7 @@ import zeroecho.sdk.util.BouncyCastleActivator;
  * with AND verification.
  * </p>
  */
+@Tag("sample")
 class HybridSigningAesTest {
 
     private static final Logger LOG = Logger.getLogger(HybridSigningAesTest.class.getName());

samples/src/test/java/demo/PostQuantumTest.java

@@ -44,6 +44,7 @@ import java.util.logging.Level;
 import java.util.logging.Logger;
 
 import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.TestInstance;
 
@@ -57,6 +58,7 @@ import zeroecho.sdk.content.api.DataContent;
 import zeroecho.sdk.util.BouncyCastleActivator;
 import zeroecho.sdk.ZeroEchoSession;
 
+@Tag("sample")
 @TestInstance(TestInstance.Lifecycle.PER_CLASS)
 class PostQuantumTest {
     private final ZeroEchoSession session = new ZeroEchoSession();

samples/src/test/java/demo/SigningAesTest.java

@@ -45,6 +45,7 @@ import java.util.logging.Logger;
 
 import javax.crypto.SecretKey;
 
+import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
 
 import zeroecho.core.alg.rsa.RsaKeyGenSpec;
@@ -59,6 +60,7 @@ import zeroecho.sdk.builders.core.PlainBytesBuilder;
 import zeroecho.sdk.content.api.DataContent;
 import zeroecho.sdk.ZeroEchoSession;
 
+@Tag("sample")
 class SigningAesTest {
     private final ZeroEchoSession session = new ZeroEchoSession();
     private static final Logger LOG = Logger.getLogger(SigningAesTest.class.getName());