test(security): backfill encryption round-trip tests for Telegram, WhatsApp, and Slack-002 channel bot tokens

[pavshulin]

Summary

Add encryption round-trip and decryption-failure tests for the channel bot token encryption that already shipped without dedicated test coverage.

Background

Trinity stores bot/auth tokens for three external channels in encrypted form via services.credential_encryption.CredentialEncryptionService (AES-256-GCM):

• telegram_bindings.bot_token_encrypted — db/telegram_channels.py
• whatsapp_bindings.auth_token_encrypted — db/whatsapp_channels.py
• slack_workspaces.bot_token (encrypted-blob-in-text-column) — db/slack_channels.py
• slack_link_connections.slack_bot_token — db/slack.py (will be encrypted as part of fix(security): Encrypt Slack and Telegram bot tokens at rest (Invariant #13) #453)

The encryption code itself is well-tested via the services.credential_encryption test suite. What's missing: per-channel integration tests that verify the round-trip through each *ChannelOperations class — encrypt-on-write, decrypt-on-read, decryption-failure handling, and the plaintext fallback path (slack_channels.py:47-49).

This was discovered during #453 investigation (see project memory project_453_slack_encryption.md) — Telegram and WhatsApp tables have no encryption-specific test files. Slack-002 (slack_channels.py) also lacks them.

Scope

For each of the three already-shipped encrypted-token storage modules, add a unit test file covering:

tests/unit/test_telegram_token_encryption.py (NEW)

• Round-trip: create_binding → raw column read → assert JSON envelope → get_decrypted_bot_token returns plaintext
• Decryption failure: tamper with envelope → _decrypt_token returns None, no exception leaks to caller
• Re-encryption on update: second create_binding for same agent_name updates the encrypted blob

tests/unit/test_whatsapp_token_encryption.py (NEW)

• Same coverage for WhatsAppChannelOperations._encrypt_auth_token / _decrypt_auth_token
• Twilio-specific: account_sid stays plaintext (it's not a credential), only auth_token_encrypted is encrypted

tests/unit/test_slack_workspaces_encryption.py (NEW)

• Round-trip for SlackChannelOperations._encrypt_token / _decrypt_token
• Plaintext fallback path at slack_channels.py:47-49 — assert that a row with raw xoxb-* bot_token returns the token via _decrypt_token (current behavior — preserves graceful handling for legacy plaintext rows)
• Verify the warning is logged

Out of scope

• slack_link_connections (db/slack.py) — this module is getting encryption added as part of fix(security): Encrypt Slack and Telegram bot tokens at rest (Invariant #13) #453, and its tests are part of that PR
• Any logic changes to the existing encryption code — pure test addition
• Architecture doc updates — already covered in fix(security): Encrypt Slack and Telegram bot tokens at rest (Invariant #13) #453

Acceptance Criteria

• test_telegram_token_encryption.py covers round-trip + decryption-failure (≥3 tests)
• test_whatsapp_token_encryption.py covers round-trip + decryption-failure (≥3 tests)
• test_slack_workspaces_encryption.py covers round-trip + decryption-failure + plaintext-fallback (≥4 tests)
• All tests use the CREDENTIAL_ENCRYPTION_KEY test fixture pattern (look at how the new db/slack.py tests do it in fix(security): Encrypt Slack and Telegram bot tokens at rest (Invariant #13) #453's PR for reference)
• Test registry (tests/registry.json) updated with the three new entries
• All tests pass against the live backend

Effort estimate

~2 hours. Mostly mechanical — copy the test pattern from tests/unit/test_slack_token_encryption.py (added in #453) and adapt for each channel's class.

References

• Originating context: fix(security): Encrypt Slack and Telegram bot tokens at rest (Invariant #13) #453 investigation (project memory project_453_slack_encryption.md)
• Encryption primitive: src/backend/services/credential_encryption.py (AES-256-GCM, JSON envelope)
• Test pattern reference: whatever tests/unit/test_slack_token_encryption.py looks like after fix(security): Encrypt Slack and Telegram bot tokens at rest (Invariant #13) #453 lands
• Architectural Invariant fix: Add ARM64 Alpine compatibility for frontend Docker build #12 (credentials handling): docs/memory/architecture.md

[AndriiPasternak31]

/claim

[github-actions]

Claimed by @AndriiPasternak31. Label status-in-progress added.

Next steps:

1. Create branch: feature/664-<short-slug>
2. Implement the feature
3. Open a PR with Fixes #664

[vybe]

Shipped in v0.6.0 (released via #998).