say when a stored token cannot be decrypted

The frame answered {"error":"internal error"} on every request. The cause was
AES-GCM failing with "Unsupported state or unable to authenticate data" — the
token in service_connections was encrypted under a key that no longer exists,
because the platform mints its encryption key on first use and does not back it
up. The same loss took slskd, memos and gitea credentials on this project's own
server earlier today.

It presented as a broken sidecar. connectionState reported `configured: true`
because a ROW exists, so the panel skipped the form and went to the frame,
where every call threw. Nothing offered a way to fix it, and the connection
form was unreachable precisely because it only appears when unconfigured.

Now a named failure. `UnreadableCredentials` is distinguished from every other
error — a database that is down keeps its own message, or a real fault would be
reported as "re-enter your token" — and the panel shows the form saying the key
changed, nothing else is lost, and the URL is still there.

Verified by the platform itself refusing to decrypt: this is the state that
machine has been in all day.

sidecar/index.ts

@@ -16,6 +16,7 @@ import {
   invalidateAllGiteaConfigs,
   normalizeBase,
   probe,
+  UnreadableCredentials,
 } from './upstream';
 import { API_URL } from '@@/officer-url.mjs';
 
@@ -109,6 +110,23 @@ async function isOwner(userId: number): Promise<boolean> {
 // The UI needs it as a value rather than as a thousand strings because this instance's ROOT_URL disagrees
 // with its public host, so links have to be rebased client-side — see retargetUrls.
 async function connectionState(userId: number): Promise<Response> {
+  // Asked first, and only for its failure: a row whose token cannot be decrypted must NOT be reported as
+  // configured. It would send the panel to the frame, which then throws on every request — which is
+  // exactly what happened, and it reads as the sidecar being broken rather than as a token needing
+  // re-entering.
+  try {
+    await getGiteaConfig(userId);
+  } catch (err) {
+    if (err instanceof UnreadableCredentials) {
+      return Response.json({
+        configured: false,
+        unreadable: true,
+        isOwner: await isOwner(userId),
+        error: err.message,
+      });
+    }
+    throw err;
+  }
   const connection = await getServiceConnection(userId, 'gitea');
   const instanceUrl = await getServiceInstanceUrl('gitea');
   return Response.json({
@@ -316,6 +334,11 @@ const server = Bun.serve({
     } catch (err) {
       // Path only. A repository body is the owner's private code.
       console.error(`[gitea] ${req.method} ${url.pathname} failed`, String(err));
+      // Named, because the remedy is specific and the generic message sends people to the logs. This one
+      // is not a fault: a token was encrypted under a key that no longer exists.
+      if (err instanceof UnreadableCredentials) {
+        return Response.json({ error: err.message, unreadable: true }, { status: 409 });
+      }
       return Response.json({ error: 'internal error' }, { status: 500 });
     }