* fix(crypto): reject plaintext fallback without crypto * test(crypto): gate no-feature regression under cfg