release(secrets-mcp): 0.5.8 — 修复更换密码短语流程

- secrets-core: change_user_key() 事务内全量解密并重加密 secrets
- web: POST /api/key-change；已有密钥时拒绝 POST /api/key-setup（409）
- dashboard: 更换密码需当前密码，调用 key-change
- 同步 Cargo.lock

crates/secrets-core/src/service/user.rs

@@ -76,6 +76,52 @@ pub async fn find_or_create_user(pool: &PgPool, profile: OAuthProfile) -> Result
     Ok((user, true))
 }
 
+/// Re-encrypt all of a user's secrets from `old_key` to `new_key` and update the key metadata.
+///
+/// Runs entirely inside a single database transaction: if any secret fails to re-encrypt
+/// the whole operation is rolled back, leaving the database unchanged.
+pub async fn change_user_key(
+    pool: &PgPool,
+    user_id: Uuid,
+    old_key: &[u8; 32],
+    new_key: &[u8; 32],
+    new_salt: &[u8],
+    new_key_check: &[u8],
+    new_key_params: &Value,
+) -> Result<()> {
+    let mut tx = pool.begin().await?;
+
+    let secrets: Vec<(uuid::Uuid, Vec<u8>)> =
+        sqlx::query_as("SELECT id, encrypted FROM secrets WHERE user_id = $1 FOR UPDATE")
+            .bind(user_id)
+            .fetch_all(&mut *tx)
+            .await?;
+
+    for (id, encrypted) in &secrets {
+        let plaintext = crate::crypto::decrypt(old_key, encrypted)?;
+        let new_encrypted = crate::crypto::encrypt(new_key, &plaintext)?;
+        sqlx::query("UPDATE secrets SET encrypted = $1, updated_at = NOW() WHERE id = $2")
+            .bind(&new_encrypted)
+            .bind(id)
+            .execute(&mut *tx)
+            .await?;
+    }
+
+    sqlx::query(
+        "UPDATE users SET key_salt = $1, key_check = $2, key_params = $3, updated_at = NOW() \
+         WHERE id = $4",
+    )
+    .bind(new_salt)
+    .bind(new_key_check)
+    .bind(new_key_params)
+    .bind(user_id)
+    .execute(&mut *tx)
+    .await?;
+
+    tx.commit().await?;
+    Ok(())
+}
+
 /// Store the PBKDF2 salt, key_check, and params for a user's passphrase setup.
 pub async fn update_user_key_setup(
     pool: &PgPool,