Use the AES factory for scoped key generation

Replace a parameterless AesCryptoServiceProvider using resource whose entire body generates and returns its key with Aes.Create(). Preserve the disposal boundary and rebind the inferred local and its members. Exclude encryption, settings, escapes, comments inside construction and conditional snapshots. Opt-in modern-.NET provider modernization; no historical Framework CSP/FIPS equivalence assertion.