AEAD: ChaCha20-Poly1305

Per-frame decryption:
  - cipher1.bin + nonce1.bin uses AAD: PlateSolve++|frame=1
  - cipher2.bin + nonce2.bin uses AAD: PlateSolve++|frame=2
  - cipher3.bin + nonce3.bin uses AAD: PlateSolve++|frame=3
  - cipher4.bin + nonce4.bin uses AAD: PlateSolve++|frame=4

Per-frame key derivation:
  For each frame i:
    1) Plate-solve: match detections to catalog stars.
    2) Keep matches with catalog mag < 6.0 and detection sigma_px < 1.2.
    3) Sort by detection flux descending.
    4) Take first 64 star_id values.
    5) Encode as little-endian u32 bytes and compute:
         key_i = SHA256(bytes)

If any star_id is wrong, AEAD authentication fails.
