[tisonkun]

Which issue does this PR close?

No linked issue.

Rationale for this change

The Azblob builder checks whether encryption_key can be used as an HTTP header, but accepts malformed Base64 and keys with invalid lengths. The server_side_encryption_with_customer_key helper also accepts raw keys of arbitrary length. Rejecting these inputs during operator construction gives callers a configuration error before attempting a storage operation.

Azure's customer-provided key contract specifies a Base64-encoded AES-256 key. This change applies that format and 32-byte length requirement at the builder boundary.

What changes are included in this PR?

• Decode configured encryption keys as standard Base64 and require exactly 32 decoded bytes.
• Return ConfigInvalid with the configuration field identified, without including the key in the error.
• Cover malformed Base64, empty keys, short and long keys, and valid 32-byte keys through both the raw-key helper and configuration entry points.
• Correct the helper documentation to describe raw key bytes and regenerate the binding and website configuration descriptions.

The invalid-key regression tests fail before the implementation change and pass afterward. Validation: 16 service unit tests and 2 doctests passed; focused Clippy and rustdoc with warnings denied, Rust formatting, and Ruff checks on the generated Python configuration file passed.

Are there any user-facing changes?

Malformed or incorrectly sized customer-provided encryption keys now fail when building an operator with ConfigInvalid. The raw-key helper retains its fluent signature; validation occurs during construction.

Breaking changes

AI Usage Statement

• Harness: Codex desktop. Model: GPT-6; the exact variant is not exposed to the agent. Effort: not exposed to the agent. Role: implemented configuration validation, regression tests, and documentation updates, and drafted this PR. Validation covers local operator construction; no live Azure requests were performed, and this PR makes no claim about weakened encryption or an Azure service-side vulnerability.
• Harness: ASF ASVS scanner. Models: gemma4-26b, qwen3-8b, and qwen3.8-27b, as listed in the scan metadata. Effort: not recorded. Role: identified missing key format and length validation; the metadata does not attribute individual findings to a model.