ec57d3fe0f
## Summary - Fixes a flaky test in `simple-secret-encryption.util.spec.ts` that fails ~1 in 256 runs - AES-256-CBC doesn't guarantee wrong-key decryption throws — PKCS7 padding validation is probabilistic. When padding accidentally looks valid, decryption silently returns garbage instead of throwing. - Changed the test to verify the correct security property: wrong-key decryption must never return the original secret (both throw and garbage are acceptable) - Audited both production `decryptSecret` call sites in `two-factor-authentication.service.ts` — they always use the correct key, so end users are not affected ## Test plan - [x] Test passes 5/5 consecutive runs locally - [x] Lint passes Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>