feat(security): add second-factor schema and encrypt free-text health notes at rest

Lay the account-security and data-sovereignty substrate for v1.23. No
user-facing behaviour yet — schema, crypto registry, redaction, and the
note-encryption data path only.

Schema + migrations:
- 0199 — User totp_secret_encrypted / totp_confirmed_at / mfa_enforced /
  passkey_upgrade_nudge_dismissed; Session mfa_verified_at / last_active_at;
  Passkey last_used_at. All additive, nullable / defaulted.
- 0200 — mfa_challenges (single-use step-up ticket; only the ticket hash is
  stored, so no session or token is ever minted before the second factor),
  mfa_recovery_codes (Argon2id at rest), webauthn_mfa_credentials (second-factor
  keys, kept separate from passkeys, which remain the passwordless-primary set).
- 0201 — mood_entries.note_encrypted + measurements.notes_encrypted (BYTEA),
  matching the existing free-text encrypted-note convention.

Free-text health notes:
- New writes encrypt the mood / measurement note into the *_encrypted column and
  null the legacy plaintext column; reads prefer the ciphertext and fall back to
  plaintext only for not-yet-migrated rows, via a single read/write helper.
- A boot-time job migrates existing plaintext rows in an idempotent,
  transactional, fail-closed pass (encrypt, then null the plaintext, per row in
  one transaction; safe to re-run; a row with content is never left both-null).
- The legacy plaintext columns are kept this release and dropped in a follow-up
  once the backfill reports zero remaining rows — the same boundary the
  key-rotation playbook uses before dropping a legacy key.

Crypto coverage:
- Register the three new encrypted columns and wire them into the key-rotation
  script so a rotation never orphans them.
- Extend the observability and log redaction denylists so TOTP secrets, MFA /
  recovery / backup codes, and export passphrases never reach a wide event.

scripts/rotate-encryption-key.ts

@@ -193,6 +193,8 @@ async function main() {
     "aiOpenaiKeyEncrypted",
     "aiOcrKeyEncrypted",
     "insuranceNumberEncrypted",
+    // v1.23 — TOTP shared secret (second factor).
+    "totpSecretEncrypted",
   ];
   for (const field of userFields) {
     results.push(await rotateStringColumn("User", field, prisma.user));
@@ -405,6 +407,22 @@ async function main() {
     ),
   );
 
+  // ───── v1.23 free-text health notes (Bytes columns) ─────
+  // "noteEncrypted" (MoodEntry) + "notesEncrypted" (Measurement). Same shared-
+  // codec shape as the clinical-spine note columns. NULL on rows whose note is
+  // still in the legacy plaintext column (pre-backfill) — `rotateBytesColumn`
+  // skips those.
+  results.push(
+    await rotateBytesColumn("MoodEntry", "noteEncrypted", prisma.moodEntry),
+  );
+  results.push(
+    await rotateBytesColumn(
+      "Measurement",
+      "notesEncrypted",
+      prisma.measurement,
+    ),
+  );
+
   console.log("\n=== Rotation summary ===");
   let totalRotated = 0;
   let totalErrors = 0;