Function backfill_once 

pub async fn backfill_once(
    store: &Store,
    client: &RestClient,
    budget: BackfillBudget,
    enc_key: Option<&[u8; 32]>,
) -> Result<usize, BackfillError>

One pass of REST backfill from meta.last_sync_watermark forward.

Fetches clips newer than the stored watermark, decrypts any encrypted clips using enc_key (when provided), writes them into the local store, and advances the watermark to the highest clip ID seen. Returns the number of clips inserted.

The HTTP layer does not decrypt — callers must supply the AES-256 key when the account uses client-side encryption. If an encrypted clip is encountered and enc_key is None, or decryption fails, the clip is logged and skipped (same policy as design doc §9 risk item).