pub fn derive_key(secret: &[u8], salt: &[u8]) -> Result<[u8; 32], String>
Derives an AES-256 key from a secret and salt using HKDF-SHA256.