backfill health code encryption GCM mode; fix dangling health code mappings for test users; refactor lock dao