introduce pre-disable-app hook and use it for the encryption app to reset migration status if the app was disabled