Derive every key from the signing key in one place (closes #315)

seal.DeriveKeys derives the session hash and block keys, the encrypted URL
key and the CSRF key from the signing key, with their salts declared beside
it, and returns them as one seal.Keys. internal/providers calls it once at
startup and provides the value to the fx graph. The session manager, the
encrypted URL generator and the CSRF protection each take their own key.
session.NewManager, encurl.NewGenerator, newCSRFProtect and handlers.New
return no error, as nothing in them can fail now. Each key is derived as
before, with seal.DeriveKey and the same salt. The signing key itself stays
the HMAC key of signed URLs and the login password. README.md says under
signing_key what it protects.

Model: opus-5-5

TODO.md

@@ -30,6 +30,17 @@ P2: security: per-origin rate limiting
 
 # Completed Steps
 
+- 2026-10-26 every key derived from the signing key is derived in one place
+  (closes #315): `seal.DeriveKeys` returns them as one `seal.Keys`, with their
+  salts declared beside it. `internal/providers` calls it once at startup. Each
+  key is derived as before, with `seal.DeriveKey` and the same salt.
+    - The session manager, the encrypted URL generator and the CSRF protection
+      each take their own key instead of the signing key.
+    - `session.NewManager`, `encurl.NewGenerator`, `newCSRFProtect` and
+      `handlers.New` return no error, as nothing in them can fail now.
+    - The signing key itself stays the HMAC key of signed URLs and the login
+      password.
+    - `README.md` says under `signing_key` what it protects.
 - 2026-10-26 the image request holds only what names the cached object (closes
   #314): its source and its transform, which the variant key covers. The signed
   URL format, the signing algorithm and every route's answers are unchanged.