refactor: make key sealing and blob storage async

[Dzejkop]

Summary

• rename DeviceKeystore / Keystore to KeySealer, rename open_sealed to unseal, and describe the non-secret binding input as context
• make KeySealer and AtomicBlobStore operations async through both the plain Rust and UniFFI adapter layers
• make key-envelope initialization, StorageKeys::init, CredentialStore::init, and the corresponding Authenticator storage lifecycle async
• serialize initialization and destruction without holding the synchronous credential-state mutex across foreign awaits
• update the CLI, testkit, tests, and walletkit-db documentation for the new API

The context contract is behavioral: unsealing under a different context must fail. Adapters may satisfy it with AEAD AAD, context-specific key selection, or an equivalent mechanism.

Validation

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy --workspace --all-targets --no-default-features -- -D warnings
• cargo test -p walletkit-db (11 passed)
• cargo test -p walletkit-core --lib (138 passed)
• cargo test -p walletkit-core --test credential_storage_integration (1 passed)
• nix develop .#wasm --command cargo check -p walletkit --features embed-zkeys --target wasm32-unknown-unknown
• generated Swift and Kotlin bindings inspected for the expected async callback and lifecycle signatures