setStrategyUIBuilderEncrypted
Persist a T2.2-encrypted UIBuilderConfig envelope on a Strategy.
The standard updateStrategy / createStrategy mutations take a typed UIBuilderConfigInput, which can't carry envelope shapes — gqlgen rejects unknown fields and the typed struct has no slot for an opaque ciphertext. This mutation is the escape hatch: it takes a single base64-prefixed $vc_t22$v1$ string and writes the row's UIBuilderConfig column with Encrypted=true + EncryptedValue=<v>, zeroing the typed fields.
Format: encryptedValue MUST start with the $vc_t22$v1$ prefix (the T2.2 envelope's packed string from console/src/crypto/passkey/strategy.ts). Plain text or other ciphertext formats are refused — write those via updateStrategy.
Call after createStrategy / updateStrategy (which writes the code + config envelope shapes) and before / after setStrategyWrappedDEKs — order between the two isn't load- bearing, but BOTH need to land before the next read or the unlock flow won't have the matching envelope set.
Returns the updated Strategy so callers can refresh their cache.
setStrategyUIBuilderEncrypted(
id: ID!
encryptedValue: String!
): Strategy!