Replace custom AES implementation with cryptography

[yozik04]

Summary

Use cryptography's AES-256-ECB implementation instead of the hand-written AES rounds. This is an independent alternative to #623, based directly on dev at dc9384b; it does not include or modify that PR.

Preserve the legacy wire/API behavior:

• Transpose each 16-byte Paradox block before and after AES; leave key byte order unchanged.
• Pad short nonempty keys to 32 bytes with 0xEE, use the first 32 bytes of longer keys, and continue rejecting empty keys.
• Pad only incomplete plaintext blocks with 0xEE; preserve empty/aligned plaintext behavior.
• Decrypt only complete ciphertext blocks, ignoring partial tails and retaining plaintext padding.
• Preserve supported byte-input types and exact serial E0 FE and IP150 framing, including checksums and IP header-length trimming.

Add the dependency to both installation manifests and update the encryption documentation. Replace the internal key-schedule test with fixed legacy ciphertext/plaintext vectors and behavioral regressions, including exact serial and IP150 wire vectors.

Compatibility and verification

• 1,749 tests passed on Python 3.14.0 (two unrelated GSM/asyncio warnings).
• 92 regression/parser tests passed against the original pure-Python implementation, loaded from the unchanged dc9384b source, as well as against the replacement. Expected ciphertext and serial/IP150 frames were captured from that original implementation, not generated through replacement round trips.
• Direct differential comparison: 5,040 key/message combinations, with key lengths 1–65, 95–97, 255 and 256 bytes and message lengths 0–65, 127, 128, 255–257 and 512 bytes. Encryption, arbitrary-ciphertext decryption and legacy-ciphertext decryption were byte-for-byte identical.
• Additional differential checks cover 720 byte-input operation cases (bytes, bytearray, memoryview, lists and tuples) and 144 empty-key rejection cases per implementation.
• Black, isort, flake8, dependency consistency and diff-whitespace checks passed.

No encryption-mode or protocol-security redesign is included: ECB and legacy padding are retained for panel compatibility.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud