OverlayPassphraseSession
Caches decrypted passphrases per key id with a TTL and a hard capacity so the overlay can decrypt repeatedly without re-prompting, while limiting exposure.
Entries expire after a fixed TTL and the oldest is evicted past the capacity limit. All stored buffers are zeroed on removal.