Configure LUKS2 disk encryption with AES-256-XTS cipher (512-bit key) and Argon2id KDF. Add cryptsetup and pam-pwquality packages. Set secure default passphrase for initial setup. 💘 Generated with Crush Assisted-by: GLM-4.7 via Crush <crush@charm.land>