Encrypt crew image payloads

[ultimate]

Motivation

• Crew image payloads can identify a person and should be protected like other PII fields (name, address, certificate).
• Use the existing crew field encryption helpers to avoid introducing a separate storage format for binary/base64 image data.

Description

• Encrypt image_data using encryptCrewField before inserting/updating crew profiles and decrypt image_data with decryptCrewField when loading rows, while leaving image_mime_type, image_width, and image_height unencrypted for display. (changes in app/lib/repositories/crew-repository.ts).
• Added encryptedImageValues and decryptImageData helpers in CrewRepository to centralize image encryption/decryption and preserve display metadata. (changes in app/lib/repositories/crew-repository.ts).
• Updated the typed shape returned by the repository to include image_data decryption and adjusted tests to verify the new behavior. (changes in tests/app/lib/repositories/crew-repository.test.ts).

Testing

• Ran the targeted repository tests with npx vitest run tests/app/lib/repositories/crew-repository.test.ts, which passed (test file: 8 tests passed).
• Ran type checking with npm run typecheck (TS compile) which succeeded.
• Ran linting with npm run lint which succeeded.
• An initial npm test run failed due to a missing installed dependency (nodemailer), dependencies were installed and the focused test run above was repeated and passed.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ultilog	Ready	Preview, Comment	Jul 11, 2026 12:50pm

[ultimate]

Implements #98