fix(fido2authenticator): fix cipher downgrades during fido2 assertion

[quexten]

Ticket: https://bitwarden.atlassian.net/browse/PM-40750 will make one before merge

Currently, cipher assertions are inadvertently using field-level encryption, and not enrolling into cipher-keys. This is a bug, and the correct public APIs of vault should be used. encrypt_composite will be removed as an impl on ciphers in a subsequent PR, making the API private.

[github-actions]

🔍 SDK Breaking Change Detection

SDK Version: cipher-full-view-part-2 (1de3e6c)

⚠️ If breaking changes are detected, a corresponding pull request addressing them must be ready for merge in the affected client repository.

Client	Status	Details
typescript	❌ Breaking changes detected	Compilation failed with new SDK version. A corresponding pull request addressing the breaking changes must be ready for merge in bitwarden/clients. - View Details
android	✅ No breaking changes detected	Compilation passed with new SDK version - View Details

---

Breaking change detection uses the build of the SDK from this branch, including any incompatibities pre-existing on or merged into this branch. Check the workflow logs to confirm.
Results update as workflows complete.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.80%. Comparing base (a9b0e18) to head (4d8d026).

Files with missing lines	Patch %	Lines
crates/bitwarden-fido/src/authenticator.rs	0.00%	16 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1287   +/-   ##
=======================================
  Coverage   85.79%   85.80%           
=======================================
  Files         484      484           
  Lines       69330    69324    -6     
=======================================
  Hits        59481    59481           
+ Misses       9849     9843    -6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR fixes FIDO2 credential save/update paths that were calling the low-level key_store.encrypt() directly, which bypassed cipher-key enrollment and blob encryption and caused cipher downgrades. Both save_credential and update_credential now route through the public vault().ciphers().encrypt() API, which internally resolves the user id, enrolls the cipher key, and selects blob vs legacy encryption. The manual MissingUserId check and EncryptionContext construction are correctly removed since the new API handles both, and the added EncryptError variant maps cleanly through the existing ?-based error flow.

Code Review Details

No blocking findings. The change is a well-scoped correctness and security improvement: it prevents credentials from being re-encrypted with weaker field-level encryption during FIDO2 assertions. The removed MissingUserId variants are still enforced inside CiphersClient::encrypt, and the key_store binding remains in use for set_new_fido2_credentials, so there is no dead code. Breaking-change detection reported no impact for TypeScript or Android.

Note: Codecov flags 0% patch coverage on the modified authenticator.rs lines. These credential-store paths were already untested before this PR, so this is a pre-existing gap rather than a regression introduced here.