fix: surface encrypted graph upload decrypt errors - #13146

Fixes encrypted first-upload in the web app failing with only a worker console log and no UI error (db-test#1128).

Problem

Uploading a local graph with encryption (app.logseq: cloud icon → Use encryption → type password twice) failed silently. The worker logged:

[frontend.worker.sync.crypt] {:db-sync/user-rsa-key-cache-invalid
 {:graph-id nil
  :first-error #error {:message "decrypt-private-key", :data {},
                       :cause DOMException OperationError}
  :retry-error #error {:message "decrypt-private-key", ...}}}

upload-graph! → <preflight-upload-e2ee! loads RSA material with graph-id nil. A WebCrypto OperationError from decrypt-private-key was treated as an RSA cache miss, retried, then rethrown without :db-sync/invalid-e2ee-password. The UI only notified for that code / decrypt-aes-key, so the user saw nothing.

Change

• Detect OperationError on the error, its message, and its cause (a truthy non-matching .name such as Error no longer hides the cause).
• Reject decrypt-private-key failures instead of resolving with an ex-info value.
• Map decrypt-private-key / OperationError to :db-sync/invalid-e2ee-password after the cache retry so the error is user-facing, not a silent cache miss.
• Treat decrypt-private-key and invalid-e2ee-password as E2EE decrypt failures in the UI.
• Always show a notification on cloud graph create/upload failure: wrong password for E2EE decrypt errors, otherwise the existing generic sync error.

Tests

• Preflight with graph-id nil + OperationError rejects with :db-sync/invalid-e2ee-password (one cache retry, not swallowed).
• OperationError detector covers named, message-only, and wrapped DOMExceptions.
• UI: decrypt-private-key shows the wrong-password notification; other upload errors show the generic sync error.