feat: govern legacy archive encryption

src/govoplan_campaign/backend/routes/campaigns.py

@@ -130,9 +130,22 @@ from govoplan_campaign.backend.route_support import (
     _write_current_version_snapshot_if_available,
     bounded_query_rows as _bounded_query_rows,
 )
+from govoplan_campaign.backend.archive_encryption import (
+    effective_archive_encryption_policy,
+)
 
 router = APIRouter(prefix="/campaigns", tags=["campaigns"])
 
+
+@router.get("/{campaign_id}/archive-encryption-policy")
+def campaign_archive_encryption_policy(
+    campaign_id: str,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("campaigns:campaign:read")),
+):
+    campaign = _get_campaign_for_principal(session, campaign_id, principal)
+    return effective_archive_encryption_policy(session, campaign).to_dict()
+
 CAPABILITY_ADDRESSES_LOOKUP = "addresses.lookup"
 CAPABILITY_ADDRESSES_RECIPIENT_SOURCE = "addresses.recipient_source"