chore: drop /data endpoint and server-side decryption

[Androz2091]

Summary

Now that frontend PR #402 (dumpus-app) uses /blob + client-side decryption, the /data endpoint, server-side decrypt_sqlite_data, fetch_package_data, and the rm_demo() module-load hack are all dead code.

This:

• Removes the /data endpoint from app.py
• Removes decrypt_sqlite_data from crypto.py
• Removes fetch_package_data from db.py
• Removes rm_demo() (no DB demo row anymore — /blob/demo lazy-seeds S3)
• Drops the encrypted_data column from saved_package_data via an idempotent `ALTER TABLE ... DROP COLUMN IF EXISTS` in db.py module init. Only iv stays in the row.
• Worker stops dual-writing the encrypted bytes to DB
• README API docs updated: /data → /blob

The README's claim that 'the encryption key must always remain on the client side, must never be stored on the server side' is now actually true.

Order of deploy

Backend first (this PR), then frontend (#402). With this merged + deployed:

• /data: 404
• /blob: returns presigned URL with iv
• saved_package_data table no longer has the encrypted_data column

Test plan

• Apply infra (no changes — drop is in app code)
• Deploy lands new code; first cold start runs the DROP COLUMN once
• /blob/demo still works (was tested last PR; nothing should regress)
• /data returns 404 (route removed)
• Real package: worker writes only iv, /blob returns presigned URL