model: introduce ID type

Based on UUIDv7 but represented to users in a more compact base32 form,
though all of that are internal implementation details.

crypto: harden API surface

Make it explicit that expiration is not being tested with Decrypt, and
test that the expiration is meaningful with DecryptWithExpiration.

Drop leftover references to gql.sr.ht

model: import from gql.sr.ht