fix(crypto): reject plaintext fallback without crypto (#4391)

* fix(crypto): reject plaintext fallback without crypto

* test(crypto): gate no-feature regression under cfg

crates/crypto/tests/no_crypto_feature.rs

@@ -0,0 +1,21 @@
+#![cfg(not(feature = "crypto"))]
+
+use rustfs_crypto::{Error, decrypt_data, encrypt_data};
+
+#[test]
+fn encrypt_data_returns_error_without_crypto_feature() {
+    let plain = b"must not be returned as ciphertext";
+
+    let result = encrypt_data(b"password", plain);
+
+    assert!(matches!(result, Err(Error::ErrCryptoDisabled)));
+}
+
+#[test]
+fn decrypt_data_returns_error_without_crypto_feature() {
+    let ciphertext = b"must not be returned as plaintext";
+
+    let result = decrypt_data(b"password", ciphertext);
+
+    assert!(matches!(result, Err(Error::ErrCryptoDisabled)));
+}