feat(5.20): US-013 retragere accounts.rar_creds_enc -> per-env + DROP cu garda

Toate citirile pe coloana legacy accounts.rar_creds_enc mutate pe sloturile
per-env (rar_creds_test_enc/rar_creds_prod_enc): worker fallback+keepalive,
are_creds (web) si are_creds_rar (integrare, +are_creds_test/_prod), write-back
API la reactivare, purjare la stergere cont, _get_acasa_context/_fetch_cont_env_state.

Contract API (aditiv): POST /v1/conturi/rar-creds primeste rar_target optional
(test/prod), scrie in slotul corect + activeaza mediul; DELETE primeste ?env
(sterge un slot sau ambele). Documentat in docs/api-rar-contract.md.

DROP cu garda in db.py (schema.sql fara coloana pe DB fresh):
- 6a: eliminat ADD COLUMN rar_creds_enc (fara ping-pong re-ADD dupa DROP)
- 6b: try/except fail-safe (nu crapa boot-ul) + garda sqlite_version >= 3.35
- 6c: re-backfill old->new imediat inainte de assert (ancora globala)
- garda orfane: DROP anulat daca vreun creds legacy nu a aterizat in slot per-env
- backup criptat accounts_rar_creds_enc_backup inainte de DROP
- 6d: verificare prin PRAGMA table_info (NU grep — submissions are aceeasi coloana)
Garda one-way, idempotenta la boot repetat (verificat). submissions.rar_creds_enc
ramane neatinsa.

tests/test_retragere_creds_enc.py: niciun read pe coloana veche, conturi rar-creds
env-aware, are_creds per-env, DROP blocat de garda la lipsa copiere. 9 teste
existente actualizate pe sloturi per-env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/v1/integrare_router.py

@@ -37,7 +37,9 @@ def ping(
       account_id         — contul rezolvat din cheie (sau 1 in dev fara cheie)
       mediu              — "test" / "prod" (settings.rar_env)
       autentificat_cu_cheie — True daca cererea a venit cu o cheie API reala valida
-      are_creds_rar      — True daca contul are rar_creds_enc stocat
+      are_creds_rar      — True daca contul are creds RAR stocate pe cel putin un mediu (test sau prod)
+      are_creds_test     — True daca contul are creds RAR pentru mediul Testare
+      are_creds_prod     — True daca contul are creds RAR pentru mediul Productie
       ts                 — timestamp ISO UTC al cererii
     """
     settings = get_settings()
@@ -55,23 +57,27 @@ def ping(
             conn.close()
         autentificat_cu_cheie = acct is not None
 
-    # Verificam daca contul are creds RAR stocate.
+    # Verificam daca contul are creds RAR stocate (per-env, US-013).
     aid = account_or_default(account_id)
     conn = get_connection()
     try:
         row = conn.execute(
-            "SELECT rar_creds_enc FROM accounts WHERE id=?", (aid,)
+            "SELECT rar_creds_test_enc, rar_creds_prod_enc FROM accounts WHERE id=?", (aid,)
         ).fetchone()
     finally:
         conn.close()
 
-    are_creds_rar = bool(row and row["rar_creds_enc"])
+    are_creds_test = bool(row and row["rar_creds_test_enc"])
+    are_creds_prod = bool(row and row["rar_creds_prod_enc"])
+    are_creds_rar = are_creds_test or are_creds_prod
 
     return JSONResponse({
         "account_id": aid,
         "mediu": settings.rar_env,
         "autentificat_cu_cheie": autentificat_cu_cheie,
         "are_creds_rar": are_creds_rar,
+        "are_creds_test": are_creds_test,
+        "are_creds_prod": are_creds_prod,
         "ts": datetime.now(timezone.utc).isoformat(),
     })