fix(security): ensure encryption at rest and buffering are never auto-enabled upon licensing without explicit admin configuration

src/Server.py

@@ -1261,14 +1261,13 @@ def get_server_public_key() -> Optional[pgpy.PGPKey]:
 
 
 def encrypt_field_for_storage(text: str, force: bool = False) -> str:
-    """
-    Encrypts a text payload using the server's OpenPGP public key if encrypt_at_rest is enabled.
-    Guarantees zero-knowledge database hosting on external database servers.
-    """
+    """Encrypts a text payload using the server's OpenPGP public key if encrypt_at_rest is enabled."""
     if not text or not isinstance(text, str):
         return text
     config = SERVER_STATE.get("config", {})
-    should_encrypt = force or config.get("encrypt_at_rest", False)
+    db_path = config.get("db_path", DEFAULT_DB_FILE)
+    is_unlocked = is_feature_licensed("enterprise_db", db_path)
+    should_encrypt = force or (is_unlocked and bool(config.get("encrypt_at_rest", False)))
     if not should_encrypt:
         return text