Reencrypt Stored Search Tool Keys

Re-encrypt stored search-tool keys with the primary OTARI_SECRET_KEY.

The search-tool half of the OTARI_SECRET_KEY rotation procedure; run it alongside POST /v1/provider-credentials/reencrypt. Rows that cannot be decrypted are left untouched and must be recovered by replacing the affected tool's key.