Save encrypted .cer, .key, and metadata to FIEL_STORAGE_PATH alongside the existing DB storage. Each file has separate .iv and .tag sidecar files. Filesystem failure is non-blocking (logs warning, DB remains primary). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>