Remove the v2 upgrade feature flags

With force-upgrade-v2-encryption on, the clients loop on any v1 account that stays v1 on a vault route: the migration check runs fullSync(false), which writes lastSync, which triggers the scheduler again. No server response stops it, so don't serve the flag until the clients fix it.

pm-30144-sdk-key-rotation and pm-31050-no-logout-key-upgrade-rotation only serve that upgrade, so they go too.

.env.template

@@ -413,10 +413,7 @@
 ##   Requires the Microsoft Store (appx) build of the desktop app. Stable releases up to and including 2026.9.1 lack the required plugin registration, so it has no effect there yet.
 ## - "pm-27278-v2-password-registration": Register new accounts with v2 encryption. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0, Android >= 2026.4.1, iOS >= 2026.5.1)
 ## - "enable-account-encryption-v2-jit-password-registration": Give SSO users who set their master password on their first login v2 encryption. (Web >= 2026.1.1, Desktop/Browser/CLI >= 2026.1.0, Android >= 2026.4.1, iOS >= 2026.6.0)
-## - "force-upgrade-v2-encryption": Upgrade every v1 account to v2 encryption the next time it's unlocked in a web, desktop, browser or CLI client. (Web >= 2026.6.4, Desktop/Browser/CLI >= 2026.7.0)
-##   These three flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2025.11.0 or newer and send their version, which rules out some older and third-party clients.
-## - "pm-30144-sdk-key-rotation": Only for clients up to 2026.10.0 (Desktop up to 2026.10.1): together with "force-upgrade-v2-encryption", a manual key rotation also upgrades a v1 account to v2.
-## - "pm-31050-no-logout-key-upgrade-rotation": Only for clients 2026.6.0 to 2026.10.0 (Desktop up to 2026.10.1): sync instead of logging out after the upgrade to v2. Newer clients always do.
+##   These two flags can't be undone: a v2 account stays v2, and it can only log in from clients that are 2025.11.0 or newer and send their version, which rules out some older and third-party clients.
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=
 
 ## Require new device emails. When a user logs in an email is required to be sent.

src/api/core/accounts.rs

@@ -1775,8 +1775,7 @@ async fn rotate_account(data: RotateData, headers: Headers, conn: DbConn, nt: No
     // Prevent logging out the client where the user requested this endpoint from.
     // If you do logout the user it will causes issues at the client side.
     // Adding the device uuid will prevent this.
-    // On an upgrade, the reason lets clients sync instead: always from 2026.10.1 (Desktop 2026.10.2), before only
-    // with `pm-31050-no-logout-key-upgrade-rotation`
+    // On an upgrade, the reason lets clients sync instead
     let reason = is_upgrade.then_some(LogOutReason::KeyRotation);
     nt.send_logout_with_reason(&user, Some(&headers.device), reason, &conn).await;
 

src/config.rs

@@ -1512,11 +1512,8 @@ pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
     // Key Management Team
     "biometrics-sdk-ipc",
     "windows-native-credential-sync",
-    "pm-30144-sdk-key-rotation",
-    "pm-31050-no-logout-key-upgrade-rotation",
     "enable-account-encryption-v2-jit-password-registration",
     "pm-27278-v2-password-registration",
-    "force-upgrade-v2-encryption",
     // Mobile Team
     "pm-34171-card-scanner",
     // Platform Team