feat(cookie): add AES-256-GCM encrypted cookie support

[brunorodmoreira]

Closes #4817

Summary

• Add setEncryptedCookie, getEncryptedCookie, generateEncryptedCookie helpers using AES-256-GCM encryption via Web Crypto API
• Add serializeEncrypted, parseEncrypted low-level utils with EncryptedCookie type
• API mirrors existing signed cookie pattern (setSignedCookie / getSignedCookie)

Crypto design

Concern	Choice
Algorithm	AES-256-GCM (crypto.subtle)
Key derivation	HKDF-SHA256 with app-specific salt
IV	Random 12 bytes per encryption
Auth tag	128-bit (full strength)
AAD	Cookie name bound as additional data
Cookie format	base64(iv || ciphertext || authTag)

The author should do the following, if applicable

• Add tests
• Run tests
• bun run format:fix && bun run lint:fix to format the code
• Add TSDoc/JSDoc to document the code

Test plan

• Round-trip set/get encrypted cookie (single key and all cookies)
• Missing cookie returns undefined
• Tampered cookie returns false
• Wrong secret returns false
• Copying encrypted value to different cookie name returns false (AAD binding)
• Secure and host prefix round-trips
• Cookie options (domain, httpOnly, maxAge, expires, sameSite)
• generateEncryptedCookie with and without options
• All 29 existing cookie tests still pass