Reject invalid SOCIAL_TOKEN_ENCRYPTION_KEY instead of 500ing.

Placeholder Fernet values like replace-with-fernet-key now raise a clear SocialCryptoError in the portal, and prod env examples no longer ship a fake key.

site/social/views.py

@@ -11,7 +11,7 @@ from django.utils.safestring import mark_safe
 from django.views.decorators.http import require_GET, require_http_methods, require_POST
 
 from messaging.services import parse_scheduled_for
-from social.crypto import encrypt_tokens
+from social.crypto import SocialCryptoError, encrypt_tokens
 from social.models import (
     Platform,
     SocialAccount,
@@ -143,7 +143,11 @@ def account_list(request):
             )
             app.client_id = client_id
             if client_secret:
-                app.encrypted_client_secret = encrypt_tokens(client_secret)
+                try:
+                    app.encrypted_client_secret = encrypt_tokens(client_secret)
+                except SocialCryptoError as exc:
+                    messages.error(request, str(exc))
+                    return redirect(f"{request.path}?connect=linkedin")
             elif not app.encrypted_client_secret:
                 messages.error(
                     request,
@@ -178,12 +182,18 @@ def account_list(request):
         elif platform == Platform.LINKEDIN:
             token_blob["author_urn"] = external_id
 
+        try:
+            encrypted = encrypt_tokens(json.dumps(token_blob))
+        except SocialCryptoError as exc:
+            messages.error(request, str(exc))
+            return redirect(f"{request.path}?connect={platform}")
+
         account, created = SocialAccount.objects.update_or_create(
             platform=platform,
             external_id=external_id,
             defaults={
                 "label": label,
-                "encrypted_tokens": encrypt_tokens(json.dumps(token_blob)),
+                "encrypted_tokens": encrypted,
                 "is_active": True,
                 "owner": request.user,
             },
@@ -273,7 +283,7 @@ def linkedin_oauth_callback(request):
                 "owner": request.user,
             },
         )
-    except LinkedInOAuthError as exc:
+    except (LinkedInOAuthError, SocialCryptoError) as exc:
         messages.error(request, str(exc))
         return redirect("social:account_list")
     except Exception: