Storage policy relocation should encrypt blobs when the destination policy has file encryption enabled

Self Checks

• I have read the Contributing Guide and Language Policy.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed. / 请使用英语提交，否则会被关闭。
• Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

I run Cloudreve Pro with OneDrive (E5) as my storage backend. Microsoft now caps my usable space, so I have to move existing files off OneDrive onto another storage policy. Because the new backend is a third-party provider I don't fully trust, I created the destination storage policy with File encryption enabled.

I then used the storage policy relocation task in the admin dashboard. The task completes successfully, but the relocated blobs are stored in plaintext on the destination — even though that policy has encryption turned on. Only files uploaded through the normal upload flow get encrypted.

So today there is no practical way to get existing files encrypted: I would have to download my entire library and re-upload it by hand, which defeats the purpose of having a server-side relocation task.

I'd like relocation to respect the destination policy's encryption setting: when relocating into an encryption-enabled policy, Cloudreve should encrypt the blob during transfer (server-side streaming encryption, the same way upload relay already does) and store the blob key, so the file ends up encrypted at rest and downloads decrypt transparently.

2. Additional context or comments

The reverse direction matters too: relocating out of an encrypted policy into a non-encrypted one should decrypt during transfer, otherwise the files end up unreadable. The docs say "all newly uploaded files to that storage policy will be encrypted" (https://docs.cloudreve.org/en/usage/file-encryption), so the current behaviour may be intentional — but from a user's perspective a policy marked as encrypted holding plaintext blobs is a surprising security expectation mismatch. If full relocation support is too much work, an admin-side "re-encrypt all blobs of this policy" maintenance task or CLI command would also solve my problem. Cloudreve version: 4.18.0, Pro.

3. Can you help us with this feature?

• I am interested in contributing to this feature.