[Lanen-xx]

What changed

• Replace the public IV-taking PKI encryption entry points with a stateful secure session API.
• Derive AEAD IVs internally from the session key, direction role, and monotonic packet sequence.
• Enforce receive sequence ordering to reject replayed or out-of-order packets.
• Update PKI session tests to cover sequence assignment, replay rejection, tag rejection, and decrypt-after-failed-tag behavior.

Verification

• powershell -ExecutionPolicy Bypass -File tools\check_format.ps1
• cmake --build build-lanen -j 1
• ctest --test-dir build-lanen --output-on-failure