feat(security): add second-factor schema and encrypt free-text health notes at rest

Lay the account-security and data-sovereignty substrate for v1.23. No
user-facing behaviour yet — schema, crypto registry, redaction, and the
note-encryption data path only.

Schema + migrations:
- 0199 — User totp_secret_encrypted / totp_confirmed_at / mfa_enforced /
  passkey_upgrade_nudge_dismissed; Session mfa_verified_at / last_active_at;
  Passkey last_used_at. All additive, nullable / defaulted.
- 0200 — mfa_challenges (single-use step-up ticket; only the ticket hash is
  stored, so no session or token is ever minted before the second factor),
  mfa_recovery_codes (Argon2id at rest), webauthn_mfa_credentials (second-factor
  keys, kept separate from passkeys, which remain the passwordless-primary set).
- 0201 — mood_entries.note_encrypted + measurements.notes_encrypted (BYTEA),
  matching the existing free-text encrypted-note convention.

Free-text health notes:
- New writes encrypt the mood / measurement note into the *_encrypted column and
  null the legacy plaintext column; reads prefer the ciphertext and fall back to
  plaintext only for not-yet-migrated rows, via a single read/write helper.
- A boot-time job migrates existing plaintext rows in an idempotent,
  transactional, fail-closed pass (encrypt, then null the plaintext, per row in
  one transaction; safe to re-run; a row with content is never left both-null).
- The legacy plaintext columns are kept this release and dropped in a follow-up
  once the backfill reports zero remaining rows — the same boundary the
  key-rotation playbook uses before dropping a legacy key.

Crypto coverage:
- Register the three new encrypted columns and wire them into the key-rotation
  script so a rotation never orphans them.
- Extend the observability and log redaction denylists so TOTP secrets, MFA /
  recovery / backup codes, and export passphrases never reach a wide event.

src/app/api/sync/changes/route.ts

@@ -50,6 +50,7 @@ import { apiHandler, requireAuth } from "@/lib/api-handler";
 import { apiSuccess, apiError } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
 import { checkRateLimit } from "@/lib/rate-limit";
+import { readNote } from "@/lib/crypto/note-cipher";
 import { TOMBSTONE_RETENTION_DAYS } from "@/lib/auth/native-client";
 import {
   decodeCursor,
@@ -249,6 +250,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
           measuredAt: true,
           source: true,
           notes: true,
+          notesEncrypted: true,
           syncVersion: true,
           deletedAt: true,
           updatedAt: true,
@@ -265,6 +267,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
           score: true,
           tags: true,
           note: true,
+          noteEncrypted: true,
           moodLoggedAt: true,
           source: true,
           syncVersion: true,
@@ -336,7 +339,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
         unit: row.unit,
         measuredAt: row.measuredAt.toISOString(),
         source: row.source,
-        notes: row.notes,
+        notes: readNote(row.notesEncrypted, row.notes),
         syncVersion: row.syncVersion,
         updatedAt: row.updatedAt.toISOString(),
       });
@@ -365,7 +368,7 @@ export const GET = apiHandler(async (request: NextRequest) => {
         mood: row.mood,
         score: row.score,
         tags: row.tags,
-        note: row.note,
+        note: readNote(row.noteEncrypted, row.note),
         moodLoggedAt: row.moodLoggedAt.toISOString(),
         source: row.source,
         syncVersion: row.syncVersion,