Fix #5 encryption — APP_KEY decode bug + move to AEAD

[techmahedy]

Bugs Fixed

Two bugs were identified and fixed in Encryption.php:

1. APP_KEY Base64 Decoding Bug

The APP_KEY value was being decoded directly using:

base64_decode(getenv('APP_KEY'))

However, Laravel-style keys are stored with a base64: prefix, so the entire "base64:XXXX..." string was being passed to base64_decode() without first removing the prefix.

Because PHP's non-strict Base64 decoder silently ignores the :, it decoded "base64" + the actual key, resulting in a corrupted 32-byte key that did not match the random bytes originally generated by key:generate.

The fix strips the base64: prefix before decoding.

This was also verified empirically: the corrected key derivation now matches:

base64_decode(substr($rawEnv, 7))

and produces a different result from the previous buggy implementation.

2. Incorrect CLI/Test Key Selection

The same method contained a "for UNIT Testing" branch based on:

PHP_SAPI === 'cli' || defined('STDIN')

These conditions are true for essentially every PHP CLI execution, not only PHPUnit runs.

As a result, normal console processes such as queue workers, scheduled commands, or php pool invocations could silently use a hardcoded testing key from the framework source code instead of the application's actual APP_KEY.

This completely disconnected encryption from the configured application key in CLI environments.

The logic has been updated to:

• Use the real APP_KEY whenever it is configured, including normal CLI commands.
• Fall back to the fixed testing key only when APP_KEY is genuinely empty.

This preserves the existing behavior required by the package's own test suite, which does not load a .env, while ensuring real CLI processes use the application's configured encryption key.