sync: detect orphaned blobs (pepper rotation) + fix AESGCM arg order

Adds an 8-byte HKDF fingerprint of the current pepper to portfolio_sync
rows. On fetch, a mismatch surfaces as 410 Gone (distinct from genuine
GCM corruption → 500), and the UI silently cleans up the dead row and
shows a soft "please re-import" notice instead of a confusing PIN
re-prompt. Legacy rows (pepper_fp NULL) are probed optimistically and
backfilled on success.

Also fixes a latent bug in unwrap(): AESGCM.decrypt args were swapped
(ct, nonce instead of nonce, ct), so restore-from-cloud always failed
even when the pepper was correct.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_portfolio_sync_api.py

@@ -72,7 +72,7 @@ def test_paid_user_round_trip(tmp_path):
     # status before any upload
     r = client.get("/api/portfolio/sync/status", cookies=cookies)
     assert r.status_code == 200
-    assert r.json() == {"exists": False, "updated_at": None}
+    assert r.json() == {"exists": False, "orphaned": False, "updated_at": None}
 
     # upload
     blob = os.urandom(512)