Get BYOK sealed-box public key

Returns the node's current X25519 sealed-box public key plus its kek_id fingerprint. The console encrypts the user's provider key against this pubkey before storing the ciphertext — the node never sees plaintext on the write path.

Honors If-None-Match: "<kek_id>" for cheap caching, returning 304 Not Modified when the cached fingerprint still matches.

curl -X GET "https://api.bitrouter.ai/v1/byok/encryption-pubkey"

{
  "kek_id": "string",
  "public_key": "string"
}