Add per-resource encrypted site publishing

[zomglings]

Summary

• add administrator-managed symmetric access keys and Ken access-policy publications
• build mixed public/AES-256-GCM static sites with client-side Web Crypto unlocking and multi-key deduplication
• apply the same per-resource protection model to articles, digests, experiments, results, and artifacts
• preserve the deterministic legacy renderer for public-only sites
• fail closed on malformed policies, incompatible derived digest content, missing keys, and partial key lifecycle operations
• bump the Claude Code plugin to 0.5.0 and document deployment/security boundaries

Verification

• 87 Python unit/integration tests
• real headless Chromium checks for key registration, subset unlocking, deduplication, persistence, and protected display math
• local dummy lorem site exercised with public, single-key, multi-key, experiment, and artifact content
• Python compileall and Node syntax validation
• claude plugin validate --strict plugins/ongo
• iterative Rath Barbarian horde review with Terra high / Luna high until no significant findings remained

🤖 Generated with Claude Code