fix(secrets): never re-encrypt secrets that fail to decrypt

[Minitour]

Summary

The at-rest migration re-encrypted any enc:v1: value it couldn't decrypt, on every database open. A process that ever started with the wrong master key (restored or swapped master.key, a different HOME, a key-store bug) re-wrapped every stored secret under that key. After that, restoring the right key no longer recovered them. Closes #305.

Stack 1/5: base develop, next #316. Merge top-down: #319 into #318, ... #316 into #315, then #315 into develop.

What changed

• canonicalizeStoredSecret only encrypts plaintext. Ciphertext that doesn't decrypt is left byte-identical and flagged.
• migrateSecretsAtRest returns how many stored secrets are undecryptable, and the database exposes it as undecryptableSecrets.
• That count is reported in three places:
  • a warning when the server starts;
  • secretStorage.undecryptable in /health;
  • a line in capa status.

Test plan

• New test: a database written under key A and opened with key B keeps every value byte-identical and reports 3 undecryptable secrets. Reopened with key A, everything decrypts again.
• Existing at-rest tests: plaintext rows are still migrated.
• bunx tsc --noEmit

Checklist

• Tests added or updated
• bunx tsc --noEmit passes
• Docs updated (if user-facing): not needed

🤖 Generated with Claude Code