encrypt_text_at_rest previously swallowed any AEAD failure with
unwrap_or_default(), silently persisting an empty ciphertext string
that is indistinguishable from a genuinely empty body on read-back.
Change its signature to return Result<String, CipherError> and
propagate failures through save_email as DatabaseError::Encryption,
resolved before the transaction begins so no row is ever written for
a message whose body failed to encrypt.
Refs #198, #162
James Maes