fix(secrets): unify encrypted-cache fallback with the merged stale-cache path

Rework the encrypted cache onto the fallback that landed in #69051:
one transport-only gate, encrypted tier replaces (never accompanies) the
plaintext tier when enabled, warning carries the failure + cache age,
in-process cache promoted on a stale hit, and clear_caches() (token
rotation) also removes the encrypted file since its key derives from
the rotated token.

tests/test_bitwarden_secrets.py

@@ -1061,9 +1061,9 @@ def test_encrypted_cache_falls_back_on_network_error(monkeypatch, tmp_path):
     )
     assert second == {"K1": "cached"}
     assert calls["n"] == 2
-    assert warnings == [
-        "Using stale encrypted Bitwarden cache after network fetching BWS secrets"
-    ]
+    assert len(warnings) == 1
+    assert "stale ENCRYPTED disk cache" in warnings[0]
+    assert "bws live fetch failed" in warnings[0]
 
 
 def test_encrypted_cache_does_not_fallback_on_auth_failure(monkeypatch, tmp_path):