How do we restore database configured with Always Encrypted between environments and enable web app to encrypt/decrypt data?
See this description of how Always Encrypted works. Basically, SQL Server does not have access to the keys required to decrypt data into plain text. This work is performed by the client driver and in your scenario, the client driver will go looking for the certificate to decrypt the data for the web application but on failing to find the correct certificate, the data will not be decrypted.

This won't cause a failure in itself, as you can see from this example if you don't have column encryption support enabled in the driver you still get results back, but when that data isn't decrypted the client driver simply returns the encrypted binary value.

It is likely, however, that your web application is relying on unencrypted data to do more than simply present a result set, and for this, you will need the certificate. If the client refuses to allow the certificate to be shared in lower environments, then you cannot use restored database copies from production in your non-production environments.