fix(startup): fail closed on key inspection errors

Propagate database inspection failures instead of treating them as
missing encrypted credentials.

This keeps startup from generating a fresh encryption key when an
existing database cannot be inspected and adds a regression test for
that path.

electron/main.js

@@ -116,8 +116,9 @@ function hasEncryptedCredentials(dbPath) {
     } finally {
       db.close();
     }
-  } catch {
-    return false;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Unable to inspect existing database at ${dbPath}: ${message}`);
   }
 }
 

scripts/bootstrap-env.mjs

@@ -87,8 +87,9 @@ function hasEncryptedCredentials(dataDir) {
     } finally {
       db.close();
     }
-  } catch {
-    return false;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Unable to inspect existing database at ${dbPath}: ${message}`);
   }
 }
 

tests/unit/bootstrap-env.test.mjs

@@ -89,3 +89,14 @@ test("bootstrapEnv refuses to generate a new key over encrypted data", () => {
     );
   });
 });
+
+test("bootstrapEnv fails closed when existing database cannot be inspected", () => {
+  withTempEnv(({ dataDir }) => {
+    fs.mkdirSync(path.join(dataDir, "storage.sqlite"), { recursive: true });
+
+    assert.throws(
+      () => bootstrapEnv({ quiet: true }),
+      /Unable to inspect existing database/
+    );
+  });
+});