Related to #25389.
`enterprise/dbcrypt/cliutil.go`'s `Rotate`, `Decrypt`, and `Delete` are
the only interface for migrating database encryption keys, but had zero
test coverage. Adds `enterprise/dbcrypt/cliutil_test.go` with per-table
regression tests for all three functions.
## Covered
The 7 tables currently handled by `Rotate`/`Decrypt`/`Delete`:
- `user_links`, `external_auth_links`
- `user_secrets`
- `gitsshkeys`
- `ai_providers`, `ai_provider_keys`, `user_ai_provider_keys`
Each table has a happy-path test verifying live rows (and, where the
schema allows it, soft-deleted rows) round-trip correctly. `Rotate` and
`Decrypt` additionally have a failure-path test per table confirming the
operation aborts cleanly with a `DecryptFailedError`, leaving data
untouched, when an active `dbcrypt_keys` entry isn't included in the
operation. `Delete` takes no cipher argument, so instead each test
confirms an encrypted row is wiped while a never-encrypted row is left
untouched by the `WHERE ... IS NOT NULL` clauses in its SQL.
## Gaps (follow-up)
`crypto_keys`, `mcp_server_configs`, and `mcp_server_user_tokens` are
encrypted at rest but are not yet handled by `Rotate`/`Decrypt`/`Delete`
at all. This is the bug reported in #25381: an incomplete
`--old-keys`/`--keys` list against these tables fails with a foreign key
violation on revoke. A follow-up PR will add both the `cliutil.go` fix
and matching regression tests for these three tables.
