Function resolve_encryption_enabled 

pub fn resolve_encryption_enabled(
    encryption_enabled_row: Option<&str>,
    security_type_row: Option<&str>,
) -> bool

Resolve “is this account encrypted?” from raw DB settings. Single source of truth — every caller (crypto::is_encryption_enabled, init_encryption_enabled, Android bg-sync) delegates here, so the answer is consistent regardless of code path.

Rules:

• encryption_enabled = "false" → not encrypted (explicit opt-out)
• encryption_enabled = "true" → encrypted (explicit opt-in)
• row missing → encrypted iff security_type exists

The security_type fallback handles pre-multi-account installs that wrote security_type without encryption_enabled. A brand-new account has neither row, so the answer is “not encrypted”.