feat(5.20): US-013 retragere accounts.rar_creds_enc -> per-env + DROP cu garda

Toate citirile pe coloana legacy accounts.rar_creds_enc mutate pe sloturile
per-env (rar_creds_test_enc/rar_creds_prod_enc): worker fallback+keepalive,
are_creds (web) si are_creds_rar (integrare, +are_creds_test/_prod), write-back
API la reactivare, purjare la stergere cont, _get_acasa_context/_fetch_cont_env_state.

Contract API (aditiv): POST /v1/conturi/rar-creds primeste rar_target optional
(test/prod), scrie in slotul corect + activeaza mediul; DELETE primeste ?env
(sterge un slot sau ambele). Documentat in docs/api-rar-contract.md.

DROP cu garda in db.py (schema.sql fara coloana pe DB fresh):
- 6a: eliminat ADD COLUMN rar_creds_enc (fara ping-pong re-ADD dupa DROP)
- 6b: try/except fail-safe (nu crapa boot-ul) + garda sqlite_version >= 3.35
- 6c: re-backfill old->new imediat inainte de assert (ancora globala)
- garda orfane: DROP anulat daca vreun creds legacy nu a aterizat in slot per-env
- backup criptat accounts_rar_creds_enc_backup inainte de DROP
- 6d: verificare prin PRAGMA table_info (NU grep — submissions are aceeasi coloana)
Garda one-way, idempotenta la boot repetat (verificat). submissions.rar_creds_enc
ramane neatinsa.

tests/test_retragere_creds_enc.py: niciun read pe coloana veche, conturi rar-creds
env-aware, are_creds per-env, DROP blocat de garda la lipsa copiere. 9 teste
existente actualizate pe sloturi per-env.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_worker_keepalive_rar.py

@@ -67,11 +67,18 @@ def _set_last_login(conn, *, ago_s: float | None):
 
 
 def _account_cu_creds(conn) -> int:
+    """Creeaza cont cu creds in slotul per-env (US-013 — legacy rar_creds_enc dropata)."""
     from app.accounts import create_account
     from app.crypto import encrypt_creds
     acct = create_account(conn, "Service Cu Creds", email="svc@example.com")
     enc = encrypt_creds({"email": "svc@example.com", "password": "secret"})
-    conn.execute("UPDATE accounts SET rar_creds_enc=? WHERE id=?", (enc, acct))
+    # US-013: scrie in slotul per-env; rar_env din fixture = valoarea default (test sau prod).
+    # Folosim rar_creds_test_enc si rar_creds_prod_enc (ambele) pentru robustete.
+    conn.execute(
+        "UPDATE accounts SET rar_creds_test_enc=?, rar_test_enabled=1, "
+        "rar_creds_prod_enc=?, rar_prod_enabled=1 WHERE id=?",
+        (enc, enc, acct),
+    )
     conn.commit()
     return acct
 
@@ -155,11 +162,14 @@ def test_target_sare_creds_nedecriptabile(env):
     settings.worker_use_test_creds = False
     # Cont cu creds GUNOI (nedecriptabile sub cheia curenta), id mai mic.
     bad = create_account(conn, "Cont Cheie Veche", email="old@example.com")
-    conn.execute("UPDATE accounts SET rar_creds_enc=? WHERE id=?", ("gAAAAA-token-invalid", bad))
+    # US-013: scrie in slotul per-env (rar_env = settings.rar_env, implicit in fixture)
+    bad_slot = f"rar_creds_{settings.rar_env}_enc"
+    conn.execute(f"UPDATE accounts SET {bad_slot}='gAAAAA-token-invalid' WHERE id=?", (bad,))
     # Cont cu creds valide, id mai mare.
     good = create_account(conn, "Cont Valid", email="good@example.com")
     enc = encrypt_creds({"email": "good@example.com", "password": "pw"})
-    conn.execute("UPDATE accounts SET rar_creds_enc=? WHERE id=?", (enc, good))
+    good_slot = f"rar_creds_{settings.rar_env}_enc"
+    conn.execute(f"UPDATE accounts SET {good_slot}=? WHERE id=?", (enc, good))
     conn.commit()
 
     acct_id, creds = _keepalive_target(conn, settings)