Address bot review on #40654:
- SecretsMigrator now tries the previous key under both the column's
configured engine and the historical AES-CBC engine, so SECRET_KEY
rotation works for AES-GCM deployments (not just CBC) while still
reading CBC source data after an engine-flipped-first migration.
- re-encrypt-secrets --engine accepts case-insensitive engine names.
- Adapter logs a warning when SQLALCHEMY_ENCRYPTED_FIELD_ENGINE is
unrecognized before falling back to AES-CBC.
- config.py points operators at the SQLALCHEMY_ENCRYPTED_FIELD_ENGINE
knob as the preferred way to switch engines.
- Add unit test covering AES-GCM SECRET_KEY rotation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
05d87edf27