encryptWithOwnerKey(plaintext: string,publicKeyJwk: string,): Promise<OwnerKeyEncrypted>
Encrypt a value with the site owner's public key (hybrid RSA+AES). Only the owner's password-derived private key can decrypt it. Used for attendee PII, email-preference blobs, and bulk-email drafts/templates. Can be called without authentication (e.g. from public ticket forms).