feat(storage key rot): remove dead born OXICLOUD_STORAGE_<N>_ENCRYPTION_CIPHER

+ alway ovewrite on storage migration (got issue when migrating with blob already existing and a key change)

example.env

@@ -371,9 +371,16 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/oxicloud
 #     `OXICLOUD_STORAGE_<N>_BACKEND` (local | s3 | azure) plus the
 #     backend-specific fields below. A missing required field aborts
 #     boot with the exact var name in the error message.
-#   * Presence of `OXICLOUD_STORAGE_<N>_ENCRYPTION_KEY` implies AES-256
-#     encryption is enabled on that entry (no separate enable flag).
-#     Bad base64 / wrong length aborts boot with the entry name.
+#   * `OXICLOUD_STORAGE_<N>_ENCRYPTION_KEY` is a comma-separated LIST
+#     of `<cipher>:<key>` pairs. Presence implies encryption is
+#     enabled on that entry (no separate enable flag). The LAST pair
+#     wins on writes; every pair is a candidate for reads. Supported
+#     ciphers: `aes-256-gcm` (default when no cipher prefix is given)
+#     and `none` (empty-key sentinel used at pair-list head for a
+#     decrypt-in-place rotation, or at tail for an encrypt-in-place
+#     rotation). Bad base64 / wrong length / duplicate keys /
+#     multiple `none` pairs abort boot with the entry name. See
+#     `docs/plan/storage-key-rotation.md` for rotation recipes.
 #   * SETTING `_ENTRIES` alongside the legacy flat vars below (e.g.
 #     `OXICLOUD_STORAGE_BACKEND` + `OXICLOUD_S3_BUCKET`) is a FAIL-FAST
 #     boot error — pick one mode. Migrate any leftover flat vars into
@@ -393,11 +400,14 @@ DATABASE_URL=postgres://postgres:postgres@localhost:5432/oxicloud
 #OXICLOUD_STORAGE_s3_prod_S3_ACCESS_KEY=
 #OXICLOUD_STORAGE_s3_prod_S3_SECRET_KEY=
 #OXICLOUD_STORAGE_s3_prod_S3_FORCE_PATH_STYLE=false
-#OXICLOUD_STORAGE_s3_prod_ENCRYPTION_KEY=  # generate: openssl rand -base64 32
-# Cipher declaration — future-proofing. Today only `aes-256-gcm` is
-# accepted (and it's the default when `_ENCRYPTION_KEY` is set), so
-# this line can be omitted. Explicit here as documentation.
-#OXICLOUD_STORAGE_s3_prod_ENCRYPTION_CIPHER=aes-256-gcm
+#OXICLOUD_STORAGE_s3_prod_ENCRYPTION_KEY=aes-256-gcm:  # generate: openssl rand -base64 32
+# The bare shorthand `<base64 key>` (no `aes-256-gcm:` prefix)
+# also works; the explicit form makes the cipher visible and is
+# required once you have more than one pair in the list.
+#
+# Two-pair rotation example (paste both pairs in .env, restart,
+# then trigger the format-upgrade job, then drop the OLD pair):
+#OXICLOUD_STORAGE_s3_prod_ENCRYPTION_KEY=aes-256-gcm:<OLD_KEY>,aes-256-gcm:<NEW_KEY>
 #
 # Repair flag: if you rename an entry in .env while the DB still points
 # at the old name, boot aborts with an actionable error pointing at: