python: decrypt rows back into models #1390

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 9 of 14.

What to build

The read side of the round trip:

cur.row_factory = dict_row
cur.execute("SELECT * FROM users")
users = cipher.decrypt(cur.fetchall())   # list[User]

decrypt takes a sequence of mappings and returns model instances constructed in Rust via the class's constructor. Row shape rules: extra columns are ignored; every declared non-Ignore field must be present; the call is all-or-nothing. EQL input is accepted as str, bytes or dict. Passthrough values are type-checked, never coerced. Ignore fields are not passed to the constructor.

Preflight (before any key request): DECRYPT_FOREIGN_ROW (a frame from another table or column), DECRYPT_MALFORMED, DECRYPT_ROW_SHAPE, DECRYPT_MISSING_COLUMN. After decryption: DECRYPT_KIND_MISMATCH, DECRYPT_NOT_REPRESENTABLE. Depends on the gate fact from ticket 3 about the frame reader; if that fact was amended, follow the amendment.

Acceptance criteria

• The snippet above returns User instances equal to the ones inserted by ticket 8's test, on all five class kinds.
• A row with an extra column decrypts; a row missing a declared column raises MISSING_COLUMN with no request.
• A payload from a different column raises FOREIGN_ROW with no request; a truncated payload raises MALFORMED with no request.
• str, bytes and dict forms of the same payload all decrypt to the same value.
• A Passthrough int column that arrives as str raises VALUE_WRONG_TYPE-class error per the spec's decrypt rules, not a coerced value.
• One malformed row in a batch of ten fails the whole call and constructs nothing.
• Decrypting rows that an SQLAlchemy class declared constructs through the SQLAlchemy constructor with Ignore relationships omitted.