fix(encryption): decrypt a new wallet with its own key version

[testimonyblockchain]

Overview

This PR fixes the wallet creation path so that a newly generated wallet is decrypted with the same key version it was encrypted under. Previously, UserService.getOrCreateUser decrypted the freshly created wallet with no version argument (falling back to version 1) and dropped the keyVersion from both the stored wallet blob and the User row. Once CURRENT_ENCRYPTION_KEY_VERSION is raised above 1, every new user's trustline step fails and the stored blob carries no version to recover from. This change makes each wallet self-describing about the key that protects it.

Related Issue

Changes

🔐 Wallet Key-Version Persistence

• [MODIFY] src/services/user.service.ts

  • Use the keyVersion returned by generateWallet for the decrypt of the newly created wallet instead of relying on the default.
  • Persist keyVersion inside the stored wallet blob (publicKey, encryptedSecret, iv, authTag, keyVersion).
  • Write encryptionKeyVersion on the User row at creation.
  • Use the stored version for later reads so existing wallets continue to work unchanged.

• [MODIFY] src/services/stellar.service.ts

  • Ensure the keyVersion from encryptBuffer is surfaced on the wallet returned by generateWallet so callers can persist and reuse it.

• [MODIFY] src/utils/encryption.util.ts

  • Keep the version-aware decrypt path consistent so callers that pass a version decrypt under that version, while the no-version fallback remains for legacy call sites.

• [MODIFY] prisma/schema.prisma

  • Add encryptionKeyVersion to the User model so the row records the version protecting its wallet.

• [MODIFY] src/__tests__/user.service.test.ts

  • Add coverage for user creation under a non-default key version, asserting the wallet blob and user row agree with the configured version and that creation succeeds above version 1.

Verification Results

npm test
✅ passes locally

Acceptance Criteria	Status
A newly created user's wallet blob and row agree with the currently configured key version	✅ keyVersion persisted in blob and encryptionKeyVersion written on the row
Creating a user succeeds with the current version set above 1	✅ Decrypt uses the returned keyVersion instead of the version-1 fallback
Existing wallets continue to work unchanged	✅ Stored version is used on later reads; legacy fallback retained
A test covers creation under a non-default key version	✅ Added to src/__tests__/user.service.test.ts
npm test passes locally	✅

Closes #239

[drips-wave]

@testimonyblockchain Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits