feat(vault): decrypt sealed recordings on read (audio at-rest) (T8.8)

src-tauri/src/audio/mod.rs

@@ -497,13 +497,16 @@ impl Resampler {
 /// through hound's size-aware iterator; hound is only used to parse the
 /// format/`fmt ` chunk.
 pub fn read_wav_mono_16k(path: &Path) -> Result<Vec<f32>, AudioError> {
-    let reader =
-        hound::WavReader::open(path).map_err(|e| AudioError::Capture(format!("open wav: {e}")))?;
-    let spec = reader.spec();
-    let channels = spec.channels.max(1) as usize;
-    drop(reader);
+    let raw = std::fs::read(path).map_err(|e| AudioError::Capture(format!("read wav: {e}")))?;
+    // Decrypt if the recording was sealed at rest (T8.8); plaintext passes through.
+    let file =
+        crate::vault::open(&raw).map_err(|e| AudioError::Capture(format!("decrypt wav: {e}")))?;
+
+    let spec = hound::WavReader::new(std::io::Cursor::new(file.as_slice()))
+        .map_err(|e| AudioError::Capture(format!("open wav: {e}")))?
+        .spec();
+    let channels = spec.channels.max(1) as usize;
 
-    let file = std::fs::read(path).map_err(|e| AudioError::Capture(format!("read wav: {e}")))?;
     let data_marker = file
         .windows(4)
         .position(|w| w == b"data")