feat(security): encrypt medication free-text notes at rest + password-change MFA step-up

Encrypt MedicationSideEffect.notes, MedicationDoseChange.note and
MedicationInventoryItem.notes with AES-256-GCM, closing the last plaintext
PHI columns left after the v1.23 note-encryption rollout. Add the three
*Encrypted Bytes columns (migration 0208), register them in the encrypted-
column rotation set, route every read/write through the note cipher, and add
a transactional fail-closed boot-time backfill for legacy rows. Plaintext
columns drop in a later release once the backfill reports zero remaining rows.

Require a fresh second factor on password change for MFA-enrolled accounts,
matching the existing step-up on MFA-disable and recovery-code regen. Redact
free-text note values from the Zod validation excerpt that can reach a wide
event.

scripts/rotate-encryption-key.ts

@@ -421,6 +421,33 @@ async function main() {
     ),
   );
 
+  // ───── v1.25 medication free-text notes (Bytes columns) ─────
+  // "notesEncrypted" (MedicationSideEffect + MedicationInventoryItem) +
+  // "noteEncrypted" (MedicationDoseChange). Same shared-codec shape as the
+  // other free-text note columns. NULL on rows whose note is still in the
+  // legacy plaintext column (pre-backfill) — `rotateBytesColumn` skips those.
+  results.push(
+    await rotateBytesColumn(
+      "MedicationSideEffect",
+      "notesEncrypted",
+      prisma.medicationSideEffect,
+    ),
+  );
+  results.push(
+    await rotateBytesColumn(
+      "MedicationDoseChange",
+      "noteEncrypted",
+      prisma.medicationDoseChange,
+    ),
+  );
+  results.push(
+    await rotateBytesColumn(
+      "MedicationInventoryItem",
+      "notesEncrypted",
+      prisma.medicationInventoryItem,
+    ),
+  );
+
   console.log("\n=== Rotation summary ===");
   let totalRotated = 0;
   let totalErrors = 0;