sync: detect orphaned blobs (pepper rotation) + fix AESGCM arg order

Adds an 8-byte HKDF fingerprint of the current pepper to portfolio_sync
rows. On fetch, a mismatch surfaces as 410 Gone (distinct from genuine
GCM corruption → 500), and the UI silently cleans up the dead row and
shows a soft "please re-import" notice instead of a confusing PIN
re-prompt. Legacy rows (pepper_fp NULL) are probed optimistically and
backfilled on success.

Also fixes a latent bug in unwrap(): AESGCM.decrypt args were swapped
(ct, nonce instead of nonce, ct), so restore-from-cloud always failed
even when the pepper was correct.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/routers/sync.py

@@ -43,6 +43,7 @@ class SyncBlobOut(BaseModel):
 
 class SyncStatusOut(BaseModel):
     exists: bool
+    orphaned: bool = False
     updated_at: datetime | None = None
 
 
@@ -73,8 +74,8 @@ async def get_status(
     principal: CurrentUser = Depends(require_paid),
     session: AsyncSession = Depends(get_session),
 ) -> SyncStatusOut:
-    exists, updated_at = await svc.fetch_status(session, principal.id)
-    return SyncStatusOut(exists=exists, updated_at=updated_at)
+    exists, orphaned, updated_at = await svc.fetch_status(session, principal.id)
+    return SyncStatusOut(exists=exists, orphaned=orphaned, updated_at=updated_at)
 
 
 @router.post("", response_model=SyncWriteOut)
@@ -108,6 +109,15 @@ async def download_blob(
         )
     try:
         result = await svc.fetch(session, principal.id)
+    except svc.SyncOrphanedError:
+        # Known state: pepper rotated. The frontend uses 410 to swap the
+        # restore form for a "stale — re-upload" CTA. Logged at INFO,
+        # not ERROR, because this isn't a server fault.
+        log.info("portfolio_sync.orphaned", user_id=principal.id)
+        raise HTTPException(
+            status_code=status.HTTP_410_GONE,
+            detail="stale_blob",
+        )
     except svc.SyncCryptoError:
         log.error("portfolio_sync.unwrap_failed", user_id=principal.id)
         raise HTTPException(