feat(web): on-prem Web DEK auto-unlock + operator toggle (v1.9.0)

The on-prem Web portal now runs its own EncryptionReconcilerService, so
admins clicking Reveal after a restart no longer see the
"(encrypted - operator must unlock)" placeholder. The behavior is gated
by a new DbEncryptionStates.WebAutoUnlockEnabled column (default true)
with a UI toggle in Settings; the Worker always ignores the toggle so
unattended scans never stall.

Highlights:
- EncryptionReconcilerService moved from Worker/Jobs to Core/Services/
  Encryption and made options-driven (ProcessName,
  RespectWebAutoUnlockToggle, PollInterval).
- New migration AddWebAutoUnlockEnabled (bit NOT NULL DEFAULT 1).
- IDataKeyService.SetWebAutoUnlockEnabledAsync (Serializable tx +
  best-effort audit).
- Settings page: status pills + Enable/Disable toggle + Lock now +
  Unlock now (inline passphrase form) + Refresh. Disabling the toggle
  also immediately locks the in-memory DEK.
- DeviceDetail.razor now catches InvalidOperationException to eliminate
  the IsUnlocked->DecryptRowValue race when the reconciler locks on a
  cross-process fingerprint mismatch.
- 7 new xUnit tests in EncryptionReconcilerServiceTests; 120/120 total.
- CHANGELOG: [1.9.0] section above [Unreleased].
- Directory.Build.props: 1.8.0 -> 1.9.0.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: robgrame

CHANGELOG.md

@@ -6,6 +6,63 @@ follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) conventions and
 
 ## [Unreleased]
 
+## [1.9.0] — 2026-06-11 — Web DEK auto-unlock + operator toggle
+
+### Added
+- **Web DEK auto-unlock**: the on-prem Web portal now runs an
+  `EncryptionReconcilerService` of its own (previously Worker-only). Within
+  ~30s of startup the Web process unwraps the DPAPI-protected passphrase blob
+  stored in `DbEncryptionStates.AutoUnlockPassphraseProtected` and unlocks the
+  in-memory DEK, so admins clicking **Reveal** on a device no longer see the
+  `(encrypted — operator must unlock)` placeholder after a restart.
+- **Operator toggle**: new
+  `DbEncryptionStates.WebAutoUnlockEnabled` column (`bit NOT NULL DEFAULT 1`,
+  migration `AddWebAutoUnlockEnabled`) gates the Web reconciler. Default `true`
+  preserves backwards compatibility on upgrade. The Worker reconciler **ignores
+  this flag** — unattended scans must always be able to write encrypted values.
+- **Settings page — "🔐 Database encryption — Web auto-unlock" fieldset**: live
+  status pills (Lifecycle, DEK locked/unlocked + fingerprint hex, DPAPI blob
+  present, toggle state) plus four admin actions:
+  - **Enable / Disable Web auto-unlock** (audited as
+    `DbEncryption.WebAutoUnlockToggleChanged`). Disabling also immediately locks
+    the in-memory DEK so the toggle takes effect without a restart.
+  - **🔒 Lock now** — zeroizes the DEK from this Web process
+    (audited as `DbEncryption.ManualLock`).
+  - **🔑 Unlock now…** — inline passphrase form for manual unlock when
+    auto-unlock is disabled or the DPAPI blob is unavailable.
+  - **↻ Refresh** — re-renders the live status.
+- `IDataKeyService.SetWebAutoUnlockEnabledAsync(bool, string operatorIdentity)`
+  with Serializable transaction + best-effort audit (DB commit never reported
+  as failed because of an audit write error).
+- 7 new xUnit tests in `EncryptionReconcilerServiceTests` covering the toggle
+  gate, fingerprint mismatch, NotInitialized / SetupPending lifecycles,
+  already-unlocked steady state, and the no-blob degraded path.
+
+### Changed
+- `EncryptionReconcilerService` moved from `BitLockerKeyMonitor.Worker/Jobs/`
+  to `BitLockerKeyMonitor.Core/Services/Encryption/` and made options-driven
+  (`EncryptionReconcilerOptions { ProcessName, RespectWebAutoUnlockToggle,
+  PollInterval }`). Worker registers with `RespectWebAutoUnlockToggle=false`,
+  Web with `true`.
+
+### Fixed
+- **Reveal race after DEK rotation**: `DeviceDetail.razor` now catches
+  `InvalidOperationException` (in addition to `CryptographicException`) around
+  `DecryptRowValue`, eliminating an unhandled-exception window where the
+  reconciler could `Lock()` the DEK on a cross-process fingerprint mismatch
+  between the `IsUnlocked` check and the decrypt call.
+- **Settings actions no longer lie about success**: audit failures in
+  `SetWebAutoUnlockEnabledAsync` and the page-level `LockNowAsync` are now
+  swallowed (logged at Warning) so a transient audit-store outage doesn't
+  surface as "Toggle failed" / "Lock failed" after the security-relevant
+  side effect has already been applied.
+
+### Security
+- Honest comment on the manual unlock form: the passphrase transits the Blazor
+  Server SignalR circuit and is held in component state on the server; managed
+  strings cannot be zeroized. Operator browser + Web host are part of the
+  trust boundary for this admin action.
+
 ### Added
 - **On-demand scan trigger**: a "Run scan now" button on the admin **Settings**
   page lets administrators start an AD/Entra scan immediately without waiting for

Directory.Build.props

@@ -6,10 +6,10 @@
     row's Version column, and the published assembly stamps in one place.
   -->
   <PropertyGroup>
-    <Version>1.8.0</Version>
-    <AssemblyVersion>1.8.0.0</AssemblyVersion>
-    <FileVersion>1.8.0.0</FileVersion>
-    <InformationalVersion>1.8.0</InformationalVersion>
+    <Version>1.9.0</Version>
+    <AssemblyVersion>1.9.0.0</AssemblyVersion>
+    <FileVersion>1.9.0.0</FileVersion>
+    <InformationalVersion>1.9.0</InformationalVersion>
 
     <Company>robgrame</Company>
     <Product>BitLocker Key Monitor</Product>

src/BitLockerKeyMonitor.Core/BitLockerKeyMonitor.Core.csproj

@@ -25,6 +25,7 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.7" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.8" />
     <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.6.0" />
     <PackageReference Include="Microsoft.Graph" Version="5.105.0" />
     <PackageReference Include="Microsoft.Identity.Client" Version="4.*" />