test(router): cover workload-identity keys with no stored ciphertext

[devin-ai-integration]

Summary

Regression test for #1017, run against a real Postgres + real Tink AEAD: a wif row (empty key_ciphertext, the column is NOT NULL) plus a normal bearer row on the same installation. On main before #1017 it fails with the exact production error, aead_factory: decryption failed, and takes the bearer key down with it — which is the part that mattered.

Gated on ROUTER_TEST_DATABASE_URL like flag_definitions_test.go, so CI's databaseless go test skips it.

Link to Devin session: https://app.devin.ai/sessions/271f32100a214fe6bc5ec69d96f13b18
Requested by: @steventohme

[greptile-apps]

PR author is not in the allowed authors list.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[claude]

Claude finished @devin-ai-integration[bot]'s task —— View job

---

No comment-length issues found.