fix(documents): encrypt staged extracted-fact PHI at rest

The inbound-document store encrypts the raw upload
(`inbound_documents.content_encrypted`) because it is sensitive clinical
data, but the per-fact staging columns persisted the same class of data in
the clear: `extracted_facts.data_json` held the transcribed clinical values
(diagnosis text, lab values, medication names, stated codes) and
`provenance_json` held the verbatim source span (up to 2000 chars copied
straight out of the report). The at-rest guarantee was defeated for staged
facts, which persist through PENDING and are retained after the decision.

Convert both columns to the AES-256-GCM `*_encrypted` BYTEA convention shared
with the note columns, going through the same Bytes codec. The upload and
fact-edit paths encrypt on write; the confirm path decrypts at commit time to
write into the normal structured stores, so the review-then-confirm flow is
unchanged. Reads are fail-closed (a bad key id throws).

Register both columns in the encrypted-columns registry and the key-rotation
script so a dropped legacy key cannot strand them (the guard test enforces
both). Migration 0220 swaps the plaintext JSONB columns for the encrypted
BYTEA columns; pre-confirm staged rows are ephemeral and cannot be
re-encrypted in SQL, so any left by a pre-release build are dropped rather
than retained as plaintext (their parent document keeps its encrypted
original).

src/app/api/documents/inbound/[id]/facts/[factId]/route.ts

@@ -17,8 +17,8 @@ import {
   returnAllZodIssues,
   safeJson,
 } from "@/lib/api-response";
-import { prisma, toJson } from "@/lib/db";
-import { serialiseFact } from "@/lib/documents/store";
+import { prisma } from "@/lib/db";
+import { encryptFactData, serialiseFact } from "@/lib/documents/store";
 import { annotate } from "@/lib/logging/context";
 import { requireModuleEnabled } from "@/lib/modules/gate";
 import {
@@ -113,7 +113,7 @@ export const PATCH = apiHandler(
     const updated = await prisma.extractedFact.update({
       where: { id: fact.id },
       data: {
-        dataJson: toJson(editToFactData(parsed.data)),
+        dataEncrypted: encryptFactData(editToFactData(parsed.data)),
         // The values are now user-asserted — the fail-closed gate is cleared.
         needsReview: false,
       },

src/app/api/documents/inbound/route.ts

@@ -40,7 +40,7 @@ import {
   resolveDailyCap,
 } from "@/lib/ai/coach/budget";
 import { auditLog } from "@/lib/auth/audit";
-import { prisma, toJson } from "@/lib/db";
+import { prisma } from "@/lib/db";
 import {
   InboundExtractError,
   runInboundExtraction,
@@ -48,6 +48,8 @@ import {
 } from "@/lib/documents/extract";
 import {
   encryptDocumentToBytes,
+  encryptFactData,
+  encryptFactProvenance,
   serialiseDocument,
 } from "@/lib/documents/store";
 import {
@@ -108,8 +110,8 @@ async function persistExtraction(args: {
           status: "PENDING" as const,
           confidence: f.confidence,
           needsReview: f.needsReview,
-          dataJson: toJson(f.data),
-          provenanceJson: toJson(f.provenance),
+          dataEncrypted: encryptFactData(f.data),
+          provenanceEncrypted: encryptFactProvenance(f.provenance),
         })),
       },
     },