fix(persistence): use ThrowsAny in tamper test; keep AesGcm exception subclass visible

src/VolcanicCore.Persistence/Encryption/EncryptionService.cs

@@ -39,16 +39,7 @@ public sealed class EncryptionService
         var cipher = wire.AsSpan(NonceSize, wire.Length - NonceSize - TagSize);
         var plain = new byte[cipher.Length];
         using var aes = new AesGcm(_key, TagSize);
-        try
-        {
-            aes.Decrypt(nonce, cipher, tag, plain);
-        }
-        catch (CryptographicException ex) when (ex.GetType() != typeof(CryptographicException))
-        {
-            // .NET throws the more specific AuthenticationTagMismatchException on tamper;
-            // normalize to the base type so callers can catch CryptographicException.
-            throw new CryptographicException("Decryption failed: authentication tag mismatch.", ex);
-        }
+        aes.Decrypt(nonce, cipher, tag, plain);
         return System.Text.Encoding.UTF8.GetString(plain);
     }
 }

tests/VolcanicCore.Tests/EncryptionServiceTests.cs

@@ -31,7 +31,7 @@ public class EncryptionServiceTests
         var bytes = Convert.FromBase64String(wire);
         bytes[^1] ^= 0x01;          // flip a bit in the tag
         var tampered = Convert.ToBase64String(bytes);
-        Assert.Throws<CryptographicException>(() => svc.Decrypt(tampered));
+        Assert.ThrowsAny<CryptographicException>(() => svc.Decrypt(tampered));
     }
 
     [Fact]