Fix EncryptedTextField crashing on plaintext values during model creation

Tortoise calls to_python_value() when setting field values at create() time,
not only when loading from DB. Add _is_fernet_token() to distinguish encrypted
DB values (≥73 decoded bytes, version 0x80) from plaintext being set — the
latter passes through untouched while wrong-key errors on real tokens still raise.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

blueprints/email/crypto_service.py

@@ -4,11 +4,27 @@ Encryption service for email credentials.
 Provides transparent Fernet encryption for sensitive fields in the database.
 """
 
+import base64
 import os
 from cryptography.fernet import Fernet
 from tortoise import fields
 
 
+def _is_fernet_token(value: str) -> bool:
+    """Return True if value looks like a Fernet token.
+
+    Fernet tokens are URL-safe base64 and decode to at least 73 bytes
+    (1 version + 8 timestamp + 16 IV + 16 min-ciphertext + 32 HMAC).
+    The first decoded byte is always 0x80 (the Fernet version byte).
+    """
+    try:
+        padded = value + "=" * (-len(value) % 4)
+        raw = base64.urlsafe_b64decode(padded.encode())
+        return len(raw) >= 73 and raw[0] == 0x80
+    except Exception:
+        return False
+
+
 class EncryptedTextField(fields.TextField):
     """
     Custom Tortoise ORM field that transparently encrypts/decrypts text values.
@@ -38,10 +54,16 @@ class EncryptedTextField(fields.TextField):
         return self.fernet.encrypt(value.encode()).decode()
 
     def to_python_value(self, value: str) -> str:
-        """Decrypt value when loading from database."""
+        """Decrypt value when loading from database.
+
+        Plaintext values (e.g. freshly-set before the first DB round-trip) are
+        returned as-is. Values that look like Fernet tokens are decrypted — a
+        wrong key still raises InvalidToken, preserving the security guarantee.
+        """
         if value is None:
             return None
-        # Decrypt Fernet token
+        if not _is_fernet_token(value):
+            return value
         return self.fernet.decrypt(value.encode()).decode()