X25519 key agreement + HKDF-SHA256 + ChaCha20-Poly1305 AEAD for opt-in payload encryption. Each message uses a fresh ephemeral key for forward secrecy. 11 new tests cover roundtrip, wrong-key rejection, tampering, wire format integration, and edge cases.