docs: standalone Working with models and objects page

[coderdan]

Summary

The old docs had guides/protect-js/working-with-models-and-objects — the canonical entry point for encryptModel / decryptModel / bulkEncryptModels / bulkDecryptModels. The new docs scatter these methods across the Drizzle, DynamoDB, and Supabase pages but never introduce them on their own.

Where it currently appears

File	Methods shown
cipherstash/encryption/drizzle.mdx:150,159,365,371,490,525	All four methods, but only in Drizzle context
cipherstash/encryption/dynamodb.mdx:105,135,160	DynamoDB-specific variants
cipherstash/encryption/supabase.mdx:428–432	Mentioned as wrapper internals
deploy/testing.mdx:42,45	Stub mocks

A user reading "Storing data" learns about encrypt/decrypt/bulkEncrypt but not about model-level methods, even though the model methods are usually what they want.

Suggested page

content/stack/cipherstash/encryption/models.mdx covering:

• The four methods (encryptModel, decryptModel, bulkEncryptModels, bulkDecryptModels)
• Schema-driven field selection — which fields get encrypted, what passes through unchanged
• Performance note: model bulk variants are a single ZeroKMS call regardless of N
• Failure shape (result.failure.{type,message})
• Cross-links to bulk-operations.mdx (raw value variants), drizzle.mdx, dynamodb.mdx

Reference material

Old page in cipherstash-js-suite git history at apps/docs/src/app/(articles)/guides/protect-js/working-with-models-and-objects/page.md (commit 1c3d40ed^).

[calvinbrewer]

Addressed. Created content/stack/cipherstash/encryption/models.mdx covering:

• The four methods (encryptModel, decryptModel, bulkEncryptModels, bulkDecryptModels)
• Schema-driven field selection (which fields encrypt, which pass through unchanged)
• Performance note: bulk model variants are a single ZeroKMS round-trip regardless of N
• Failure shape (result.failure.{type, message})
• Decision rule: model methods when round-tripping whole records; raw bulkEncrypt when encrypting a list of one specific field's values
• Cross-links to bulk-operations.mdx (docs: standalone Bulk operations page for the Encryption SDK #6), Drizzle/DynamoDB/Supabase adapters, and the autogen EncryptionClient reference for full signatures

Lives in the new ---Operations--- group in encryption/meta.json, ordered before bulk-operations (most readers want record-level methods first).

Pending review on a working branch.