fix(db): load bundled SQLCipher on Linux desktop (stop startup segfault)

The Linux app segfaulted when opening the encrypted DB. Root cause: on Linux we
overrode package:sqlite3 to the SYSTEM libsqlcipher.so, but sqlcipher_flutter_libs
statically links its own SQLCipher into libsqlcipher_flutter_libs_plugin.so and
exports the sqlite3_* symbols globally. Two SQLite/SQLCipher builds loaded in one
process → symbol clash → segfault at sqlite3_open (before PRAGMA key).

Fix: _openLinuxCipher() now prefers the ABI-matched bundled plugin .so
(libsqlcipher_flutter_libs_plugin.so), falling back to the system lib only if the
plugin isn't present (e.g. host test/CI layouts). Android is unaffected (uses the
bundled Android lib as before).

Verified: Linux desktop build runs without crashing; full suite 37/37, and the
"no plaintext at rest" test now runs (not skipped) on the dev host with system
libsqlcipher, confirming real encryption.

apps/app_seeds/lib/db/encrypted_executor.dart

@@ -19,9 +19,13 @@ void useSqlCipher() {
 }
 
 DynamicLibrary _openLinuxCipher() {
-  // The dev package ships the `libsqlcipher.so` symlink; runtime packages ship
-  // only a versioned name (`.so.0`, `.so.1`, …). Try them in turn.
+  // sqlcipher_flutter_libs statically links SQLCipher inside its plugin .so and
+  // exports the sqlite3_* symbols — and it is ABI-matched to the `sqlite3` Dart
+  // package. Prefer it; the system libsqlcipher is a different build (linked to
+  // system libcrypto) and segfaults on open. Fall back to the system lib only
+  // if the bundled plugin isn't present (e.g. some test/CI layouts).
   const candidates = [
+    'libsqlcipher_flutter_libs_plugin.so',
     'libsqlcipher.so',
     'libsqlcipher.so.1',
     'libsqlcipher.so.0',