V2 Encryption followups (#7963)

* Add the account recovery V2 upgrade routes

GET /organizations/{orgId}/users/keys/pending-v2-upgrades lists, a page at a
time, the memberships whose account recovery key still wraps the member's V1
user key after an upgrade to V2 encryption, with the upgrade token the admin
re-wraps it from. POST .../v2-upgrades stores the re-wrapped keys in one
transaction, or unenrolls the members whose token holds no usable key. Only
Owners and Admins, an Admin never for Owners, and a membership that changed
since the read is skipped. GET /organizations/{orgId}/private-key gives the
organization's private key these need, to everyone with Manage users as
upstream. The SDK's encrypted migrator calls all three.

Enrolling in or withdrawing from account recovery drops a leftover upgrade
token, which would otherwise get a member who re-enrolled after the upgrade
unenrolled.

* Check membership for the organization public key in the handler

The public key routes serve the placeholder SSO organization's key to users
without an organization, so they couldn't require the member guard, but it
still ran for every request: it logged a membership error for each legitimate
v2 JIT password setup and authenticated the request twice. The routes now
authenticate once, return the placeholder key first, and check the membership
themselves, with the same rule as the guard.

* List attachments in sync with a stable URL

Sync and the cipher responses list each attachment with an unsigned URL of
upstream's form, which no longer changes on every sync nor costs a presign per
attachment on S3, and which isn't served without a token. The attachment routes
sign it: the cipher route and its admin variant, and the emergency access view's
route the web vault downloads through, which is added. The admin variant also
signs it for a member who can open the item themselves, because the web vault's
fallback to the listed URL no longer works.

* Seed the SDK live tests' vectors with their attachments

Sync now lists attachments with a stable URL, so the rotation test's before and after comparison holds with them.
Only the legacy attachments without a key of their own stay out: the SDK refuses to rotate a vault holding one.

tools/sdk-live-tests/seed_vector.py

@@ -26,11 +26,12 @@ def main() -> int:
         print("no master password")
         return SKIP
 
-    # Without attachments: the rotation test compares the vault before and after, and our sync gives each attachment
-    # a link with a fresh download token every time (upstream's is the same on every sync). A vector's legacy
-    # attachments, without a key of their own, would also make the SDK refuse to rotate at all.
+    # Without the legacy attachments that have no key of their own: the SDK refuses to rotate a vault holding one
+    # (`OldAttachments`), on any server.
     for cipher in vector.get("vault", {}).get("ciphers", []):
-        cipher.get("encrypted", {}).pop("attachments", None)
+        encrypted = cipher.get("encrypted", {})
+        if encrypted.get("attachments"):
+            encrypted["attachments"] = [a for a in encrypted["attachments"] if a.get("key")] or None
 
     credentials = base64.b64encode(f"{username}:{password}".encode()).decode()
     request = urllib.request.Request(