Function derive_key 

pub fn derive_key(password: &str, salt: &[u8]) -> Result<VaultKey, String>

Derives a 32-byte AES-256 key from password and salt using Argon2id (m=65536 KiB, t=3, p=1 — OWASP 2023 recommendation).