backfill health code encryption GCM mode; fix dangling health code mappings for test users; refactor lock dao

More robust to throw an exception here