V2 Encryption followups (#7963)

* Add the account recovery V2 upgrade routes

GET /organizations/{orgId}/users/keys/pending-v2-upgrades lists, a page at a
time, the memberships whose account recovery key still wraps the member's V1
user key after an upgrade to V2 encryption, with the upgrade token the admin
re-wraps it from. POST .../v2-upgrades stores the re-wrapped keys in one
transaction, or unenrolls the members whose token holds no usable key. Only
Owners and Admins, an Admin never for Owners, and a membership that changed
since the read is skipped. GET /organizations/{orgId}/private-key gives the
organization's private key these need, to everyone with Manage users as
upstream. The SDK's encrypted migrator calls all three.

Enrolling in or withdrawing from account recovery drops a leftover upgrade
token, which would otherwise get a member who re-enrolled after the upgrade
unenrolled.

* Check membership for the organization public key in the handler

The public key routes serve the placeholder SSO organization's key to users
without an organization, so they couldn't require the member guard, but it
still ran for every request: it logged a membership error for each legitimate
v2 JIT password setup and authenticated the request twice. The routes now
authenticate once, return the placeholder key first, and check the membership
themselves, with the same rule as the guard.

* List attachments in sync with a stable URL

Sync and the cipher responses list each attachment with an unsigned URL of
upstream's form, which no longer changes on every sync nor costs a presign per
attachment on S3, and which isn't served without a token. The attachment routes
sign it: the cipher route and its admin variant, and the emergency access view's
route the web vault downloads through, which is added. The admin variant also
signs it for a member who can open the item themselves, because the web vault's
fallback to the listed URL no longer works.

* Seed the SDK live tests' vectors with their attachments

Sync now lists attachments with a stable URL, so the rotation test's before and after comparison holds with them.
Only the legacy attachments without a key of their own stay out: the SDK refuses to rotate a vault holding one.

src/api/core/accounts.rs

@@ -1244,10 +1244,11 @@ struct CommonUnlockData {
     v2_upgrade_token: Option<V2UpgradeTokenData>,
 }
 
-/// Lets other sessions with the v1 user key unwrap the v2 one after an upgrade. Opaque to us.
+/// Lets other sessions with the v1 user key unwrap the v2 one after an upgrade. Opaque to us. Stored on the user and
+/// the memberships as this serializes, and read back with it (the account recovery V2 upgrade routes).
 #[derive(Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
-struct V2UpgradeTokenData {
+pub(crate) struct V2UpgradeTokenData {
     wrapped_user_key1: String,
     wrapped_user_key2: String,
 }