fix(audit-g5c): set CURATOR_BOOTSTRAP_NEW_KEY=1 in conftest

CredentialCrypto's safety check fires on create_app() instantiation
because the test environment has no pre-seeded Fernet key file. Set
the bootstrap env var before any test imports so the auto-create path
is allowed during tests.

tests/conftest.py

@@ -8,18 +8,25 @@ migration code paths.
 
 import os
 
-import pytest
-import pytest_asyncio
-from sqlalchemy import create_engine
-from sqlalchemy.ext.asyncio import (
+# Audit 2026-06-02: CredentialCrypto now refuses to auto-generate a
+# Fernet key without explicit opt-in (production safety against silent
+# key regeneration on partial restore). The test environment never has
+# a pre-seeded key file, so set the bootstrap flag here before any
+# create_app() / CredentialCrypto() import path fires.
+os.environ.setdefault("CURATOR_BOOTSTRAP_NEW_KEY", "1")
+
+import pytest  # noqa: E402
+import pytest_asyncio  # noqa: E402
+from sqlalchemy import create_engine  # noqa: E402
+from sqlalchemy.ext.asyncio import (  # noqa: E402
     AsyncSession,
     async_sessionmaker,
     create_async_engine,
 )
-from sqlalchemy.orm import sessionmaker
+from sqlalchemy.orm import sessionmaker  # noqa: E402
 
-from backend.app import create_app
-from backend.app.models import Base
+from backend.app import create_app  # noqa: E402
+from backend.app.models import Base  # noqa: E402
 
 
 def _async_database_url() -> str: