fix: harden security and tune task performance

src/test/java/com/svnlog/web/service/TaskPersistenceServiceTest.java

@@ -29,14 +29,22 @@ public class TaskPersistenceServiceTest {
         task.setError("");
         task.setCreatedAt(Instant.parse("2026-03-01T10:00:00Z"));
         task.setUpdatedAt(Instant.parse("2026-03-01T10:05:00Z"));
+        task.setAiReasoningText("reasoning text should stay out of history");
+        task.setAiAnswerText("answer text should stay out of history");
         task.getFiles().add("md/a.md");
 
         service.save(storePath, Arrays.asList(task));
 
+        String persistedJson = new String(Files.readAllBytes(storePath), java.nio.charset.StandardCharsets.UTF_8);
+        Assertions.assertFalse(persistedJson.contains("reasoning text should stay out of history"));
+        Assertions.assertFalse(persistedJson.contains("answer text should stay out of history"));
+
         List<TaskInfo> loaded = service.load(storePath);
         Assertions.assertEquals(1, loaded.size());
         Assertions.assertEquals("task-1", loaded.get(0).getTaskId());
         Assertions.assertEquals(TaskStatus.SUCCESS, loaded.get(0).getStatus());
+        Assertions.assertEquals("", loaded.get(0).getAiReasoningText());
+        Assertions.assertEquals("", loaded.get(0).getAiAnswerText());
         Assertions.assertEquals(1, loaded.get(0).getFiles().size());
         Assertions.assertEquals("md/a.md", loaded.get(0).getFiles().get(0));
     }

src/test/java/com/svnlog/web/util/CryptoUtilsTest.java

@@ -0,0 +1,32 @@
+package com.svnlog.web.util;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class CryptoUtilsTest {
+
+    @TempDir
+    Path tempDir;
+
+    @AfterEach
+    public void clearCryptoProperties() {
+        System.clearProperty("svnlog.crypto.key");
+        System.clearProperty("svnlog.crypto.keyFile");
+    }
+
+    @Test
+    public void shouldEncryptAndDecryptWithGeneratedKeyFile() throws Exception {
+        Path keyFile = tempDir.resolve("crypto.key");
+        System.setProperty("svnlog.crypto.keyFile", keyFile.toString());
+
+        String encrypted = CryptoUtils.encrypt("secret-value");
+        Assertions.assertNotEquals("secret-value", encrypted);
+        Assertions.assertTrue(Files.exists(keyFile));
+        Assertions.assertEquals("secret-value", CryptoUtils.decrypt(encrypted));
+    }
+}