Function encrypt_site_files 

pub fn encrypt_site_files(
    site: &SiteFiles,
    password: &str,
    embed_key: Option<&EmbeddedKey>,
    rng: &mut (impl RngCore + CryptoRng),
) -> SiteFiles

Encrypt all content files in a planned site, replacing them with decrypt shells (for HTML pages) or base64-encoded encrypted payloads (for JSON files).

Pure (§5.1): transforms a SiteFiles into an encrypted SiteFiles. Infrastructure files (lesson-runner.js, feedback.js, styles.css, etc.) are passed through unchanged. Content files (index.html, lessons/*.json, lessons.json, eval-results.html) are encrypted with AES-256-GCM + PBKDF2.

When embed_key is Some, the index.html payload is a JSON object {"html":"...","embeddedKey":{...}} (§3.2) so the decrypt shell can extract the key and pre-load it into the learner’s sessionStorage. The key is inside the ciphertext — never plaintext in any shipped file.

plan_site is unchanged — this is a separate post-processing step (§2.1), so the 55+ existing plan_site tests are unaffected.