feat(cli): port encryption commands to native TypeScript

[Coly010]

Promotes supabase encryption get-root-key and encryption update-root-key from Go-proxy handlers to native Phase 1+ TypeScript Effect handlers in the legacy shell. The command is still exposed in the Go CLI (cmd/encryption.go, GroupID: groupManagementAPI), so this is an in-scope strict 1:1 port. Closes CLI-1300.

What changed

• get-root-key — resolves the project ref, calls GET /v1/projects/{ref}/pgsodium, and prints the bare root key + \n to stdout (Go fmt.Println parity). JSON/stream-json modes emit a structured result.
• update-root-key — reads the new key from stdin (masked clack prompt on a TTY, trimmed piped bytes otherwise; empty/whitespace → "", matching Go's io.Copy + strings.TrimSpace), calls PUT /v1/projects/{ref}/pgsodium, and prints Finished supabase root-key update. to stderr (Go's utils.Aqua rendered as plain text per the legacy convention).
• encryption.errors.ts — new family-root error module with mapLegacyEncryptionHttpError({ networkVerb, statusVerb }) over the shared mapLegacyHttpError. Go uses different verbs for the network vs status message of each subcommand, so the factory takes both.
• SIDE_EFFECTS.md — consolidates the two per-subcommand docs into one group-level file and corrects the API route: the old proxy docs listed /v1/projects/{ref}/config/database/vault; the real route is /v1/projects/{ref}/pgsodium.
• Telemetry — both commands wrap with withLegacyCommandInstrumentation; --project-ref is intentionally not telemetry-safe here (no markFlagTelemetrySafe on the Go encryption group), so it is redacted. PersistentPostRun parity (linked-project cache + telemetry flush on success and failure) via the Effect.ensuring pair.
• Status tracker — both subcommands flipped wrapped → ported.

Reviewer notes

• update-root-key is the first legacy command to wire the Stdin service. Because Layer.provide does not share to siblings inside Layer.mergeAll, the command composes stdinLayer with its Tty + Stdio deps explicitly so the layer is self-contained. Verified against the bundled binary (./dist/supabase-legacy …) to rule out a Service not found panic that in-process tests miss.
• Known divergence (documented in SIDE_EFFECTS.md): the TTY masked prompt uses clack's framing rather than Go's bare Enter a new root key: stderr write; the label text matches. Piped mode reads stdin directly without printing the prompt, mirroring Go's io.Copy branch.