fix: V24 encrypt existing plain text phone numbers

backend/src/main/java/com/srsystem/migration/V24__encrypt_existing_phones.java

@@ -0,0 +1,55 @@
+package com.srsystem.migration;
+
+import com.srsystem.util.PhoneEncryptionConverter;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.flywaydb.core.api.migration.BaseJavaMigration;
+import org.flywaydb.core.api.migration.Context;
+import org.springframework.stereotype.Component;
+
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class V24__encrypt_existing_phones extends BaseJavaMigration {
+
+    private final PhoneEncryptionConverter converter;
+
+    @Override
+    public void migrate(Context context) throws Exception {
+        var conn = context.getConnection();
+        int encrypted = 0;
+        int skipped = 0;
+
+        ResultSet rs = conn.createStatement().executeQuery(
+                "SELECT id, phone FROM tb_employee WHERE phone IS NOT NULL"
+        );
+
+        PreparedStatement update = conn.prepareStatement(
+                "UPDATE tb_employee SET phone = ? WHERE id = ?"
+        );
+
+        while (rs.next()) {
+            Long id = rs.getLong("id");
+            String phone = rs.getString("phone");
+
+            try {
+                converter.convertToEntityAttribute(phone);
+                skipped++;
+            } catch (Exception e) {
+                String encryptedPhone = converter.convertToDatabaseColumn(phone);
+                update.setString(1, encryptedPhone);
+                update.setLong(2, id);
+                update.executeUpdate();
+                encrypted++;
+            }
+        }
+
+        rs.close();
+        update.close();
+
+        log.info("V24 migration complete: {} encrypted, {} already encrypted", encrypted, skipped);
+    }
+}