sync: detect orphaned blobs (pepper rotation) + fix AESGCM arg order

Adds an 8-byte HKDF fingerprint of the current pepper to portfolio_sync
rows. On fetch, a mismatch surfaces as 410 Gone (distinct from genuine
GCM corruption → 500), and the UI silently cleans up the dead row and
shows a soft "please re-import" notice instead of a confusing PIN
re-prompt. Legacy rows (pepper_fp NULL) are probed optimistically and
backfilled on success.

Also fixes a latent bug in unwrap(): AESGCM.decrypt args were swapped
(ct, nonce instead of nonce, ct), so restore-from-cloud always failed
even when the pepper was correct.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

alembic/versions/0016_portfolio_sync_pepper_fp.py

@@ -0,0 +1,39 @@
+"""portfolio_sync: add pepper_fp for orphan-blob detection.
+
+When PORTFOLIO_SYNC_PEPPER rotates (intentional or otherwise), any
+existing wrapped blob becomes permanently unreadable. Today that
+manifests as a GCM InvalidTag → 500 on the GET endpoint. We add a
+short HKDF-derived fingerprint of the pepper so we can detect the
+rotation case explicitly and surface it to the client as a clean
+"stale" state (410), distinct from genuine corruption (500).
+
+Existing rows get pepper_fp=NULL on upgrade; the service treats NULL
+as "orphaned" (always true: those rows were written before this
+column existed, so we can't prove the pepper matches). The next
+successful upsert refreshes the fingerprint.
+
+Revision ID: 0016
+Revises: 0015
+Create Date: 2026-05-25
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision: str = "0016"
+down_revision: Union[str, None] = "0015"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "portfolio_sync",
+        sa.Column("pepper_fp", sa.LargeBinary(length=8), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("portfolio_sync", "pepper_fp")