fix(documents): encrypt staged extracted-fact PHI at rest

The inbound-document store encrypts the raw upload
(`inbound_documents.content_encrypted`) because it is sensitive clinical
data, but the per-fact staging columns persisted the same class of data in
the clear: `extracted_facts.data_json` held the transcribed clinical values
(diagnosis text, lab values, medication names, stated codes) and
`provenance_json` held the verbatim source span (up to 2000 chars copied
straight out of the report). The at-rest guarantee was defeated for staged
facts, which persist through PENDING and are retained after the decision.

Convert both columns to the AES-256-GCM `*_encrypted` BYTEA convention shared
with the note columns, going through the same Bytes codec. The upload and
fact-edit paths encrypt on write; the confirm path decrypts at commit time to
write into the normal structured stores, so the review-then-confirm flow is
unchanged. Reads are fail-closed (a bad key id throws).

Register both columns in the encrypted-columns registry and the key-rotation
script so a dropped legacy key cannot strand them (the guard test enforces
both). Migration 0220 swaps the plaintext JSONB columns for the encrypted
BYTEA columns; pre-confirm staged rows are ephemeral and cannot be
re-encrypted in SQL, so any left by a pre-release build are dropped rather
than retained as plaintext (their parent document keeps its encrypted
original).

src/lib/documents/commit.ts

@@ -18,6 +18,7 @@
  */
 import { encryptToBytes } from "@/lib/ai/coach/bytes-codec";
 import { prisma } from "@/lib/db";
+import { decryptFactData } from "@/lib/documents/store";
 import { resolveOrMintBiomarker } from "@/lib/labs/biomarker-store";
 import type { ExtractedFact } from "@/generated/prisma/client";
 import type {
@@ -152,20 +153,14 @@ export async function commitApprovedFact(
   userId: string,
   fact: ExtractedFact,
 ): Promise<CommittedRecordRef> {
+  // Decrypt the staged payload at confirm time to write it into the normal
+  // structured store. Fail-closed: a bad key id throws and aborts the commit.
+  const data = decryptFactData(fact.dataEncrypted);
   if (fact.factType === "OBSERVATION") {
-    return commitObservation(
-      userId,
-      fact.dataJson as unknown as ObservationFactData,
-    );
+    return commitObservation(userId, data as ObservationFactData);
   }
   if (fact.factType === "CONDITION") {
-    return commitCondition(
-      userId,
-      fact.dataJson as unknown as ConditionFactData,
-    );
+    return commitCondition(userId, data as ConditionFactData);
   }
-  return commitMedication(
-    userId,
-    fact.dataJson as unknown as MedicationStatementFactData,
-  );
+  return commitMedication(userId, data as MedicationStatementFactData);
 }