OptionalpassphraseKey derivation mode for the passphrase.
"derive" (default): Use PBKDF2 with 100k iterations for user passphrases.
Recommended for production use. Provides strong protection against brute-force
and dictionary attacks. First unlock will take ~50-100ms.
"raw": Use SHA-256 only. For pre-derived keys or advanced users who handle
key derivation themselves. Allows full control over KDF algorithm, iterations,
and progress UI.
Options for configuring the EncryptedPouch