fix(crypto): rotate the ECG waveform column + guard rotation coverage

The v1.19.0 EcgRecording.waveformEncrypted Bytes column was not added to the
key-rotation script, so an operator rotation would strand ECG waveforms on the
legacy key and dropping it would make them permanently undecryptable — the same
class as the v1.18.1 clinical-spine gap. Wire the column into the rotation and
add a schema-driven coverage test that fails CI if any encrypted Bytes column
is ever left out again.

scripts/rotate-encryption-key.ts

@@ -370,6 +370,19 @@ async function main() {
     ),
   );
 
+  // ───── v1.19.0 ECG waveform (Bytes column) ─────
+  // "waveformEncrypted" holds the JSON-encoded micro-volt sample array in the
+  // same `encrypt()` ciphertext-string-as-UTF-8 shape the Coach columns use
+  // (see src/lib/withings/ecg-waveform-codec.ts), so the generic Bytes
+  // rotation re-stamps it without decoding the waveform.
+  results.push(
+    await rotateBytesColumn(
+      "EcgRecording",
+      "waveformEncrypted",
+      prisma.ecgRecording,
+    ),
+  );
+
   console.log("\n=== Rotation summary ===");
   let totalRotated = 0;
   let totalErrors = 0;