fix(ai): treat a stored provider key that cannot be opened as no key

A key id retired from ENCRYPTION_KEYS, or a corrupt row, made decrypt throw
inside the provider builders, and a briefing generation answered 500. An
unreadable key now drops its entry from the chain like a missing one, with a
warning on the event, so the generation answers the no-provider 422
(ai.provider.none). The connection test reads it as no stored key. The
parity walk holds that case to the contract again.

tests/integration/routes/parity/__snapshots__/insights-generate.P09-unreadable-key.json.snap

@@ -1,23 +1,23 @@
 {
-  "status": 500,
+  "status": 422,
   "body": {
     "data": null,
-    "error": "Interner Serverfehler",
+    "error": "No AI provider configured. Connect ChatGPT in settings or ask your admin to set up an API key.",
     "meta": {
-      "errorCode": "http.internal",
+      "errorCode": "ai.provider.none",
       "requestId": "<requestId>"
     }
   },
   "events": [
     {
-      "status": 500,
+      "status": 422,
       "action": null,
       "meta": null,
-      "warnings": null,
-      "error": {
-        "type": "TypeError",
-        "message": "Invalid authentication tag length: 0"
-      }
+      "warnings": [
+        "ai: a stored provider key could not be opened",
+        "ai: a stored provider key could not be opened"
+      ],
+      "error": null
     }
   ],
   "effects": [],

tests/integration/routes/parity/insights-generate.parity.test.ts

@@ -797,11 +797,7 @@ describe("POST /api/insights/generate parity", () => {
     await post(
       "P09-unreadable-key",
       { force: true },
-      {
-        auth: unreadableKey,
-        userId: UNREADABLE_KEY_ID,
-        undeclared: "an unreadable stored key ends in 500 (pinned as it is)",
-      },
+      { auth: unreadableKey, userId: UNREADABLE_KEY_ID },
     );
   });