P1 follow-ups: track 4 audit items deferred from PR #1

[abk1969]

This issue tracks the 4 P1 follow-ups deferred from the 2026-04-26 P0 security audit (PR #1 was merged on 2026-04-28).

Full plan: docs/superpowers/plans/2026-04-26-p1-followups.md (not yet committed to main — stub body used)

Tasks

• Task 0 — v1→v2 ciphertext re-encryption migration (unblocks ENCRYPTION_KEY rotation)
• Task 1 — Replace EUR-Lex mock with real Puppeteer scraping + Redis cache (closes audit finding Phase 2 Section B — Portfolio (hook + table + page) #5)
• Task 2 — Zod validation of LLM JSON outputs in agents (closes Phase 2 Section C — Wizard 7-step (T10-T21) #6)
• Task 3 — db.transaction() on multi-table writes in storage.ts (closes Phase 2 Section D — System Detail (5 tabs + versions compare) #7)
• Task 4 — Delete decryptV1Legacy after 7-day prod soak

Order: 0 → 1 → 2 → 3 → 4. Task 0 first because it unblocks ENCRYPTION_KEY rotation.

Automated 14-day kickoff after PR #1 merge.