chore: improve jwt at-rest token encryption

[paustint]

No description provided.

[Copilot]

Pull request overview

This PR upgrades the shared at-rest token encryption primitive from legacy unauthenticated AES-256-CBC to authenticated AES-256-GCM, while preserving backward compatibility by auto-detecting and decrypting previously-stored CBC ciphertext. It also updates API service documentation/comments to reflect the new versioned ciphertext format and adds unit tests to lock in the compatibility and tamper-detection behavior.

Changes:

• Switch encryptString to write AES-256-GCM with a gcm!-prefixed, colon-safe payload format and keep decryptString backward-compatible with legacy CBC blobs.
• Add unit tests covering: GCM-by-default output, round-trips, legacy CBC decryption compatibility, and tamper detection.
• Update service-level comments/docs in Salesforce org encryption and JWT token encryption to reflect the new authenticated encryption behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
libs/shared/node-utils/src/lib/shared-node-utils.ts	Implements versioned encryption: write GCM (gcm!…) and read both GCM + legacy CBC.
libs/shared/node-utils/src/lib/tests/shared-node-utils.encryption.spec.ts	Adds tests for GCM output, compatibility with legacy CBC, and tamper detection.
apps/api/src/app/services/salesforce-org-encryption.service.ts	Updates inline documentation to reflect authenticated GCM writes and legacy read-only debt.
apps/api/src/app/services/jwt-token-encryption.service.ts	Updates documentation to reflect versioned encrypt/decrypt primitives and GCM-by-default behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.