fix(server,asana): return real error from /proceed-db-migration instead of bare 500

[bujjibabukatta]

Summary

Fixes #9066. /proceed-db-migration was returning a 500 with no body on upgrade, so there was no way to tell what actually failed without going into the container logs.

Root cause

The endpoint wrapped services.ExecuteMigration() in errors.Must(), which panics on any error. Gin's recovery middleware turns that into an empty 500, so the real failure never made it back to the client.

While looking for what's actually breaking on the beta12 -> beta15 upgrade path, I found 20260509000001_encrypt_connection_token.go in the asana plugin. It's new in beta13 and it's the first migration here that touches ENCRYPTION_SECRET during the migration itself. If that key is missing or doesn't match what was used before, it fails - and because of the bug above, that failure was invisible.

Fix

• api.go: check the error from ExecuteMigration() and return it with shared.ApiOutputError instead of panicking, same as the rest of the file already does.
• asana migration: clearer error message when ENCRYPTION_SECRET isn't set, skip tokens that are already encrypted (so re-running after a failure doesn't double-encrypt them), and include the connection id if encryption fails on a row.

Note: I can't confirm the asana part is the exact thing the reporter hit since there's no log/stack trace in the issue, but with the api.go fix the next attempt will actually show the real error, so we'll know for sure.