pub async fn reencrypt_camera_passwords(pool: &SqlitePool) -> Result<usize>Expand description
One-time migration: when a key is configured, seal any legacy-plaintext camera passwords. Idempotent (skips already-sealed rows). Returns how many rows were re-encrypted. No-op when no key is set.