Note: Uses AES-256-GCM with PBKDF2-SHA256 (390k iterations) for key derivation. The password is not stored.