feat(security): implement Phase 2 Modell A (Steganografischer Alibi-Carrier für Plausible Deniability)

src/mount.rs

@@ -107,13 +107,17 @@ pub async fn mount_container(
         .read_meta()
         .context("Konnte Container-Header nicht lesen")?;
 
-    let (dek, version, vault_id) = match auth {
+    let (dek, carrier_dek, carrier_node_id, version, vault_id) = match auth {
         ContainerAuth::Password(ref password) => {
             ui::step(2, 4, "🔑", "Leite KEK via Argon2id ab (konstante Zeit über alle Slots)...");
             match meta.authenticate(password) {
-                Some((dek, ver, slot_id)) => {
+                Some(keys) => {
                     ui::step(3, 4, "🔓", "Master-Passwort erfolgreich verifiziert & DEK entschlüsselt!");
-                    (dek, ver, slot_id)
+                    let vault_id = keys.slot_id();
+                    let ver = keys.version();
+                    let c_dek = keys.carrier_dek();
+                    let c_nid = keys.carrier_node_id();
+                    (keys.0, c_dek, c_nid, ver, vault_id)
                 }
                 None => {
                     bail!("Ungültiges Master-Passwort oder Container beschädigt");
@@ -132,12 +136,20 @@ pub async fn mount_container(
                 !children.is_empty()
             };
             let vault_id = if is_hidden { 1 } else { 0 };
-            (dek, meta.version, vault_id)
+            (dek, None, None, meta.version, vault_id)
         }
     };
 
-    // WebDAV Filesystem und Handler konfigurieren (mit Anti-Leak Shield & Vault-Routing)
-    let fs = SanctumFs::with_vault(db.clone(), dek, version, anti_leak, vault_id);
+    // WebDAV Filesystem und Handler konfigurieren (mit Anti-Leak Shield & Carrier-Routing)
+    let fs = SanctumFs::with_carrier(
+        db.clone(),
+        dek,
+        carrier_dek,
+        carrier_node_id,
+        version,
+        anti_leak,
+        vault_id,
+    );
     let last_activity = fs.last_activity();
     let dav_server = DavHandler::builder()
         .filesystem(Box::new(fs))