security: fix Bitwarden password exposure and ChaCha nonce hardening

Issue 12: pass bw unlock password via stdin (--passwordstdin) instead of
as a CLI arg, preventing it from appearing in /proc/<pid>/cmdline or ps output.

Issue 11: replace Nonce::default() (all-zero) with the first 12 bytes of the
16-byte random payload nonce. The key-nonce pair was already unique per message
(HKDF salt), but using an explicit non-zero nonce removes the latent risk of
accidental key reuse and makes the safety invariant self-documenting.

Closes #11, closes #12

crates/notsecrets/src/encrypt.rs

@@ -82,7 +82,13 @@ impl Encryptor {
         let payload_key = derive_payload_key(&file_key, &nonce_bytes)?;
 
         let cipher = ChaCha20Poly1305::new(Key::from_slice(&payload_key));
-        let counter_nonce = Nonce::default(); // [0u8; 12]
+        // Use the first 12 bytes of the 16-byte random nonce as the ChaCha nonce.
+        // The payload key is already unique per message (derived via HKDF with the full
+        // 16-byte nonce as salt), so this is safe — but using a non-zero nonce makes
+        // the invariant explicit and removes the latent risk of accidental key reuse.
+        let counter_nonce = Nonce::from(
+            <[u8; 12]>::try_from(&nonce_bytes[..12]).expect("slice is exactly 12 bytes"),
+        );
         let ciphertext = cipher
             .encrypt(&counter_nonce, plaintext)
             .map_err(|_| AgeError::CryptoError("payload encryption failed".to_string()))?;