fix(audit-g5c): refuse silent Fernet key regeneration on partial restore

Audit 2026-06-02: `_load_or_create_key` silently minted a new Fernet
key whenever the key file was missing — no log, no warning. The
failure mode the audit flagged: a partial disaster restore where the
DB was restored but `/images/secrets/` was lost would produce a
working-looking system in which every authenticated download fails
AUTH_ERROR until the operator re-uploads every credential by hand.

Two opt-ins now needed for auto-creation:
  1. Explicit `bootstrap_ok=True` kwarg (tests, scripts), OR
  2. `CURATOR_BOOTSTRAP_NEW_KEY=1` env var (operator first-time setup)

Otherwise the constructor raises `MissingCredentialKey` so the app
fails fast at startup and the operator can restore the key file
from backup before encrypted_blob rows go undecryptable.

Also: docstring path was wrong (said "images/data root" but actual
location is `/images/secrets/credential_key.b64`) — corrected.

Tests updated to pass `bootstrap_ok=True` explicitly, and two new
tests cover the safety behavior (missing-key-raises, env-var-bootstraps).

tests/test_download_service.py

@@ -130,7 +130,7 @@ async def test_download_source_attaches_written_files(
         thumbnailer=Thumbnailer(images_root=images_root),
         settings=sync_settings,
     )
-    crypto = CredentialCrypto(tmp_path / "key.b64")
+    crypto = CredentialCrypto(tmp_path / "key.b64", bootstrap_ok=True)
     cred_service = CredentialService(db, crypto)
 
     svc = DownloadService(
@@ -405,7 +405,7 @@ async def test_backfill_decrements_after_run(
         session=db_sync, images_root=images_root, import_root=images_root,
         thumbnailer=Thumbnailer(images_root=images_root), settings=sync_settings,
     )
-    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64"))
+    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64", bootstrap_ok=True))
     svc = DownloadService(
         async_session=db, sync_session=db_sync,
         gdl=fake_gdl, importer=importer, cred_service=cred_service,
@@ -446,7 +446,7 @@ async def test_backfill_auto_resets_on_clean_zero_files(
         thumbnailer=Thumbnailer(images_root=tmp_path / "images"),
         settings=sync_settings,
     )
-    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64"))
+    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64", bootstrap_ok=True))
     svc = DownloadService(
         async_session=db, sync_session=db_sync,
         gdl=fake_gdl, importer=importer, cred_service=cred_service,
@@ -484,7 +484,7 @@ async def test_tick_mode_does_not_touch_backfill_counter(
         thumbnailer=Thumbnailer(images_root=tmp_path / "images"),
         settings=sync_settings,
     )
-    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64"))
+    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64", bootstrap_ok=True))
     svc = DownloadService(
         async_session=db, sync_session=db_sync,
         gdl=fake_gdl, importer=importer, cred_service=cred_service,
@@ -529,7 +529,7 @@ async def test_partial_error_type_maps_to_ok_status(
         session=db_sync, images_root=images_root, import_root=images_root,
         thumbnailer=Thumbnailer(images_root=images_root), settings=sync_settings,
     )
-    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64"))
+    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64", bootstrap_ok=True))
     svc = DownloadService(
         async_session=db, sync_session=db_sync,
         gdl=fake_gdl, importer=importer, cred_service=cred_service,
@@ -582,7 +582,7 @@ async def test_download_enqueues_thumbnail_and_ml_per_attached_image(
         session=db_sync, images_root=images_root, import_root=images_root,
         thumbnailer=Thumbnailer(images_root=images_root), settings=sync_settings,
     )
-    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64"))
+    cred_service = CredentialService(db, CredentialCrypto(tmp_path / "key.b64", bootstrap_ok=True))
 
     # Capture the IDs that the orchestrator hands off to each Celery task.
     # The .delay() shim runs inside DownloadService._phase3_persist (lazy