Feat v0.6.3 dead code sweep (#38)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/crypto/backfill.go

@@ -10,7 +10,7 @@ import (
 // provider_configs.api_key_plain using the env-derived key, writing the
 // result to api_key_enc (BYTEA) + key_nonce. Clears api_key_plain after.
 //
-// This runs once on upgrade from v0.9.3 → v0.9.4. Subsequent starts are
+// This runs once on upgrade when ENCRYPTION_KEY is first set. Subsequent starts are
 // a no-op (api_key_plain will be NULL for all rows).
 //
 // Personal-scope keys are temporarily encrypted with the env key. They get
@@ -94,7 +94,7 @@ func EnforceEncryptionKey(db *sql.DB, encryptionKey string) error {
 
 	// Check if any plaintext keys exist (pre-backfill)
 	var hasPlaintext bool
-	// api_key_plain column may not exist on fresh v0.9.4+ installs
+	// api_key_plain column may not exist on fresh installs
 	var colExists bool
 	db.QueryRow(`
 		SELECT EXISTS (
@@ -121,7 +121,7 @@ func EnforceEncryptionKey(db *sql.DB, encryptionKey string) error {
 		if hasPlaintext {
 			return fmt.Errorf(
 				"ENCRYPTION_KEY is not set but plaintext API keys need encryption. " +
-					"Set ENCRYPTION_KEY before starting (required for v0.9.4+)",
+					"Set ENCRYPTION_KEY before starting (required+)",
 			)
 		}
 		log.Println("  ⚠ ENCRYPTION_KEY not set — API key encryption disabled (OK for fresh install with no providers)")