backfill health code encryption GCM mode; fix dangling health code mappings for test users; refactor lock dao

This may be a patch permanently needed?  Log it as an error.