chore: record iqon encrypted db archive

reports/db-archive-encrypted-storage-2026-05-20.md

@@ -0,0 +1,49 @@
+# IQON DB archive encrypted storage
+
+Purpose: record durable encrypted storage of the verified IQON database archive without storing raw credentials or SQL dumps in git.
+
+Created: 2026-05-20
+Updated: 2026-05-20
+
+## Status
+
+`VERIFIED`: the database archive was encrypted, decryption was tested through `gzip -t`, the encryption key was stored in Vaultwarden, and plaintext temporary files were removed.
+
+## Encrypted artifact
+
+| Field | Value |
+|---|---|
+| Path | `/Users/svmac/.codex/memories/secure-artifacts/iqon/iqon-u0012812_iqon-20260520-231601.sql.gz.enc` |
+| Mode | `600` |
+| Size | approximately `468K` |
+| Algorithm | `openssl enc -aes-256-cbc -salt -pbkdf2 -iter 200000` |
+| Source DB | `u0012812_iqon` |
+
+## Vaultwarden key item
+
+| Field | Value |
+|---|---|
+| Item name | `IQON DB archive encryption key - 20260520-231601` |
+| Folder | `Client Infrastructure` |
+| Stored secret | encryption passphrase |
+
+## Checksums
+
+| Artifact | SHA-256 |
+|---|---|
+| Source gzip before plaintext cleanup | `65625e331661df6fc1cff220f10e634b0afd8967aba2387764c0e9ea0698be56` |
+| Encrypted artifact | `8f1244a5f9b4e9fb2c5d0491c6f92affbf12125437a67560af6ab774efd61083` |
+
+## Verification
+
+1. Source gzip passed `gzip -t` before encryption.
+2. Encrypted artifact was created with PBKDF2 and AES-256-CBC.
+3. Decryption was piped directly to `gzip -t` without writing plaintext SQL.
+4. Vaultwarden key item was created successfully.
+5. Temporary plaintext passphrase file was removed.
+6. Temporary plaintext DB dump in `/private/tmp` was removed.
+7. Encrypted artifact remains present at the durable local path.
+
+## Safety
+
+No database dump or password is stored in the git repository. This report contains only paths, metadata, and checksums.