Fetch the MPIN encryption key fresh before every encryption

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/modules/auth/services/authApi.ts

@@ -15,15 +15,15 @@ import type {
 /**
  * `MALFORMED_REQUEST` on an MPIN call is what a stale or wrong public key looks
  * like from the client — the server will not say more, because saying more
- * would leak whether the profile exists. So drop the cached key, re-fetch, and
- * try exactly once more. A second failure is a real problem worth surfacing.
+ * would leak whether the profile exists. The key is fetched fresh on every
+ * encryption, so a retry picks up a rotated key; try exactly once more.
+ * A second failure is a real problem worth surfacing.
  */
 const withKeyRetry = async <T>(call: () => Promise<T>): Promise<T> => {
   try {
     return await call();
   } catch (error) {
     if (isCbsApiError(error) && error.code === 'MALFORMED_REQUEST') {
-      mpinCrypto.invalidate();
       return call();
     }