refactor(encryption+filesystem): Contracts + exception relocation (task 2.9 + 2.10)

[agissept]

Stacked on #44 (base migration/3.8-console-fire-handle). Bundles two small strict-mode-tighten tasks over disjoint files.

2.9 — Encryption → L13 Contracts (91282268)

• Encrypter implements Contracts\Encryption\{Encrypter, StringEncrypter}
  • add getAllKeys() / getPreviousKeys() — single-key fork (key rotation / previous_keys arrives with the illuminate/encryption swap; ponytail comment)
  • remove setKey() — strict-mode method-not-found (0 callers in fork/app)
  • encrypt() failure throws Contracts\Encryption\EncryptException instead of \RuntimeException; constructor keeps \RuntimeException for unsupported cipher/key (matches v13)
• DecryptException canonical location moves to Contracts\Encryption\DecryptException; old Illuminate\Encryption\DecryptException becomes a class_alias bridge so existing catch sites still match the thrown contract exception
• new Contracts\Encryption\StringEncrypter (copy of v13); container resolves both encryption contracts to 'encrypter'
• fork callsites converged to the contract (Cookie\Guard, EncrypterTest)
• drop symfony/security-core — only referenced by two dead imports in Encrypter; also removes transitive symfony/password-hasher (verified 0 usage in src)

2.10 — Filesystem FileNotFoundException → Contracts (46e9710b)

• canonical location moves to Contracts\Filesystem\FileNotFoundException; Filesystem uses/throws it
• old Illuminate\Filesystem\FileNotFoundException becomes a class_alias bridge (catch identity)
• provider already binds 'files' via singleton() (done in task 3.5) → no provider change

Bridge pattern (reusable)

class_alias — not a subclass — is required when relocating an exception class: a subclass can't catch the (parent) contract exception that gets thrown, so old catch sites would silently miss. App-side repoint is grep-driven (Psalm is blind to class_alias), consistent with the cache/events/console guards.

Validation

• php -l clean; inline runtime check passes (alias identity, old-name catch matches thrown contract, Encrypter instanceof both contracts, setKey gone)
• full fork suite 1644 green (= 3.8 baseline); convergence ratchet all at baseline

App-side conform (repoint imports + guard + integration validation) tracked separately.

🤖 Generated with Claude Code