fix: handle non-deterministic AES-256-CBC decryption in crypto test (#26383)

AES-256-CBC doesn't guarantee throwing on wrong key decryption - it depends
on whether the decrypted bytes happen to have valid PKCS#7 padding. The test
now verifies that decryption either throws OR returns a value different from
the original plaintext.

This fixes flaky test failures that started appearing after the Vitest 4.0
upgrade, where the 'Closing rpc while fetch was pending' error was a secondary
symptom of the test failure causing worker teardown during module loading.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

packages/lib/crypto.test.ts

@@ -1,6 +1,6 @@
-import { describe, it, expect } from "vitest";
+import { describe, expect, it } from "vitest";
 
-import { symmetricEncrypt, symmetricDecrypt } from "./crypto";
+import { symmetricDecrypt, symmetricEncrypt } from "./crypto";
 
 describe("crypto", () => {
   const testKey = "12345678901234567890123456789012"; // 32 bytes key
@@ -49,11 +49,24 @@ describe("crypto", () => {
       expect(() => symmetricDecrypt(":", testKey)).toThrow();
     });
 
-    it("should throw error if wrong key is used", () => {
+    it("should fail to decrypt correctly if wrong key is used", () => {
       const encrypted = symmetricEncrypt(testText, testKey);
       const wrongKey = "12345678901234567890123456789013"; // Different 32 bytes key
 
-      expect(() => symmetricDecrypt(encrypted, wrongKey)).toThrow();
+      // AES-256-CBC doesn't guarantee throwing on wrong key - it depends on whether
+      // the decrypted bytes happen to have valid PKCS#7 padding. The test verifies
+      // that decryption either throws OR returns a value different from the original.
+      let decryptedWithWrongKey: string | null = null;
+      let threwError = false;
+
+      try {
+        decryptedWithWrongKey = symmetricDecrypt(encrypted, wrongKey);
+      } catch {
+        threwError = true;
+      }
+
+      // Either it threw an error, or the decrypted value is not the original text
+      expect(threwError || decryptedWithWrongKey !== testText).toBe(true);
     });
 
     it("should handle empty string encryption/decryption", () => {