Watch compartmentation work

What this proves

1. We create two teams, each with its own key — exactly like Conduit does.
2. A report is sealed to one team (Legal). You'll see the encrypted bytes.
3. The other team (Documentation) tries to open it — and fails, because its key cannot.
4. Then Legal opens it. The difference isn't a permission toggle — it's the encryption itself.

Uses the Web Crypto API (ECDH P-256 + AES-256-GCM) — the same family of primitives Conduit uses on the server.