easterbrooka catches the encryption rollout before it ships broken

easterbrooka's fork is rolling out encryption-at-rest - the kind of feature that keeps sensitive client data unreadable to anyone who manages to peek at the database. This change fixes a quiet but fatal gap in that rollout: encrypted values weren't being formatted in the way the database actually expected. The first attempt to save a sealed record in production would have failed outright, and lookups that match users by their hashed email would have silently broken alongside it.

The fix itself is small but disciplined. Every encrypted value heading to storage now gets wrapped in the right shape on the way out, and the team added tests that simulate the exact failure the production system would have surfaced - so any future regression trips an alarm before it leaves a laptop.