#383 CRITICAL: Fail-open encryption allows insecure DB connections

db.py:143-146 and db.py:380-384 - When encryption configuration fails, system logs warning but continues with unencrypted connection. Violates fail-safe principle. Fix: Convert to fail-closed - refuse connection if encryption fails.