AES 字段加密迁配置并兼容旧密文

移除字段加密硬编码主密钥，改为 FIELD_ENCRYPTION_KEY 注入。

保留 FIELD_ENCRYPTION_LEGACY_KEY 透明回退旧密文，新写入统一使用主密钥；生产环境校验主密钥和 legacy 密钥长度、占位符及相等关系，并统一生产环境判断口径。

补充配置与旧密文兼容回归测试。

backend/internal/e2e/rental_flow_test.go

@@ -232,10 +232,10 @@ func newFlowServices(db *gorm.DB) flowServices {
 		order:          order.NewService(orderRepo),
 		payment:        payment.NewService(paymentRepo),
 		paymentConfig:  paymentconfig.NewService(configRepo),
-		paymentAccount: paymentaccount.NewService(paymentaccount.NewRepository(db)),
+		paymentAccount: paymentaccount.NewService(paymentaccount.NewRepository(db, &crypto.MockEncryptor{})),
 		dispute:        dispute.NewService(disputeRepo),
 		wallet:         wallet.NewService(walletRepo),
-		withdrawal:     withdrawal.NewService(withdrawal.NewRepository(db, walletRepo)),
+		withdrawal:     withdrawal.NewService(withdrawal.NewRepository(db, walletRepo, &crypto.MockEncryptor{})),
 		finance:        adminfinance.NewService(adminfinance.NewRepository(db)),
 	}
 }
@@ -362,7 +362,7 @@ func seedUsers(t *testing.T, db *gorm.DB) (model.User, model.User, uint64) {
 
 func seedRealname(t *testing.T, db *gorm.DB, userID uint64, name string, verifiedAt time.Time) {
 	t.Helper()
-	encryptedName, err := crypto.Encrypt(name)
+	encryptedName, err := (&crypto.MockEncryptor{}).Encrypt(name)
 	if err != nil {
 		t.Fatalf("加密实名姓名失败: %v", err)
 	}