feat(security): encrypt Contact.email at rest + blind index (G3)

[tdrabikdev]

First slice of the PII encrypt-at-rest epic — the final feature epic toward 2.0.0 (design: docs/superpowers/specs/2026-07-10-pii-encrypt-at-rest-design.md).

What

Contact.email is now encrypted at rest (encrypted cast; column widened to text). Because encryption uses a random IV, the plaintext unique + lookup indexes can't survive it — a deterministic blind index email_hash (HMAC-SHA256 of the normalised email, unique) carries both uniqueness and equality lookups.

• Contact::hashEmail() + a saving hook keep email_hash in sync; it's guarded from mass-assignment.
• Every email equality site rewritten to the blind index: LiveChatService, PersonalizationService, the portal DocumentResource (customer→contact match), ContactListController (search + autocomplete), and the model scopeSearch. Table email search is now exact (partial LIKE is gone — documented tradeoff; masking already gated it off for free).
• App\Support\PiiEncryptionBackfill (idempotent) encrypts + hashes existing rows in the migration.

Money columns stay plaintext (they need DB sort/range/SUM for forecasting; masking already hides them from free).

Notable

MySQL-verified caught a real bug: the text change needed both email indexes (contacts_email_unique and contacts_email_index) dropped first — MySQL 1170, which sqlite masked.

Tests

New ContactEmailEncryptionTest (encrypted-at-rest, blind index deterministic + case-insensitive, lookup, uniqueness, idempotent backfill). Reconciled the query/assert regressions ( → ; email search → exact). Full suite 1138 passed / 1 skipped; PHPStan 0-new; Pint clean; MySQL-verified.

Next

Slice 2 — encrypt Contact.phone_number + Company.phone_number (no blind index; drop their LIKE search).

VERSION → 2.0.0-rc.1.

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Security	1 high

View in Codacy

🟢 Metrics 16 complexity · 0 duplication

Metric	Results
Complexity	16
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}