fix(storage): bound the key-registry queries in master-key rotation

Addresses the Aikido code-quality finding on #7155: rotateMasterKey() and
verifyMasterKey() loaded every key row and filtered in memory. Both now push
the predicate into the query (findByMasterKeyVersionLessThan /
countByMasterKeyVersionLessThan), so the rotation check costs a counted
query rather than a full table read.

The SaaS boot-probe fix that originally shared this commit landed on its own
in #7265, so only the rebase leftovers remain here: one assertion proving a
storage-disabled node resolves no master key at boot.

Author: ConnorYoh

app/proprietary/src/main/java/stirling/software/proprietary/storage/crypto/FileEncryptionKeyService.java

@@ -177,10 +177,8 @@ public void invalidate(UUID keyId) {
      */
     public int rotateMasterKey() throws StorageEncryptionException {
         int rewrapped = 0;
-        for (FileEncryptionKey row : repository.findAll()) {
-            if (row.getMasterKeyVersion() >= masterKey.currentVersion()) {
-                continue;
-            }
+        for (FileEncryptionKey row :
+                repository.findByMasterKeyVersionLessThan(masterKey.currentVersion())) {
             byte[] kek = unwrapRow(row);
             row.setWrappedKey(
                     Base64.getEncoder()
@@ -199,10 +197,7 @@ public int rotateMasterKey() throws StorageEncryptionException {
      */
     public void verifyMasterKey() {
         if (masterKey.hasPreviousKey()) {
-            long pending =
-                    repository.findAll().stream()
-                            .filter(r -> r.getMasterKeyVersion() < masterKey.currentVersion())
-                            .count();
+            long pending = repository.countByMasterKeyVersionLessThan(masterKey.currentVersion());
             if (pending > 0) {
                 log.warn(
                         "{} encryption key row(s) are still wrapped by the previous master key."

app/proprietary/src/main/java/stirling/software/proprietary/storage/repository/FileEncryptionKeyRepository.java

@@ -1,5 +1,6 @@
 package stirling.software.proprietary.storage.repository;
 
+import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
 
@@ -18,4 +19,12 @@ Optional<FileEncryptionKey> findFirstByScopeTypeAndScopeIdOrderByKeyVersionDesc(
             FileEncryptionKey.ScopeType scopeType, long scopeId);
 
     Optional<FileEncryptionKey> findFirstByStatus(FileEncryptionKey.Status status);
+
+    /**
+     * Rows still wrapped by an older master key. Counting and fetching are separate so the startup
+     * check can ask the database for a number instead of materialising every row.
+     */
+    long countByMasterKeyVersionLessThan(int masterKeyVersion);
+
+    List<FileEncryptionKey> findByMasterKeyVersionLessThan(int masterKeyVersion);
 }

app/proprietary/src/test/java/stirling/software/proprietary/storage/config/StorageProviderConfigTest.java

@@ -123,6 +123,8 @@ void storageDisabled_neverQueriesTheKeyRegistry() {
         StorageEncryptionState state = newState(cfg);
 
         assertThat(state.isWriteEnabled()).isFalse();
+        // No probe means no eager init, so no master key is resolved on a node that never stores.
+        assertThat(state.isMaterialised()).isFalse();
         verify(keyRepo.mock, never()).count();
     }
 

app/proprietary/src/test/java/stirling/software/proprietary/storage/crypto/InMemoryKeyRepo.java

@@ -63,6 +63,24 @@ public InMemoryKeyRepo() {
                                         .findFirst());
         when(mock.count()).thenAnswer(inv -> (long) rows.size());
         when(mock.findAll()).thenAnswer(inv -> java.util.List.copyOf(rows.values()));
+        when(mock.countByMasterKeyVersionLessThan(org.mockito.ArgumentMatchers.anyInt()))
+                .thenAnswer(
+                        inv ->
+                                rows.values().stream()
+                                        .filter(
+                                                r ->
+                                                        r.getMasterKeyVersion()
+                                                                < inv.<Integer>getArgument(0))
+                                        .count());
+        when(mock.findByMasterKeyVersionLessThan(org.mockito.ArgumentMatchers.anyInt()))
+                .thenAnswer(
+                        inv ->
+                                rows.values().stream()
+                                        .filter(
+                                                r ->
+                                                        r.getMasterKeyVersion()
+                                                                < inv.<Integer>getArgument(0))
+                                        .toList());
         when(mock.findAll(any(org.springframework.data.domain.Sort.class)))
                 .thenAnswer(inv -> java.util.List.copyOf(rows.values()));
     }