read
Retrieves the encryption key from TBS via GET /v1/backup/encrypt-key.
This is used during recovery and eject flows. It sends both the Authorization header (client API key) and the X-Firebase-Token header (Firebase ID token).
On a 401 response, the token is refreshed and the request is retried once.
Return
The encryption key as a string.
Throws
If the token is unavailable or the TBS request fails.