Derive the cold-start unlock key from the passkey PRF, not the public key (#14)

Cold-start unlock wrapped the database key under the credential *public* key.
A public key is public: mavweb writes it verbatim to passkeys.json, normally in
the same state dir as db_key.wrapped, so anyone holding both files recovered the
database key offline with no authenticator involved. The wrapped blob was a
plaintext key with extra steps.

The secret is now the WebAuthn PRF extension output — 32 bytes the authenticator
computes over a fixed salt and never stores anywhere. The blob gains a version:

  v2:  "MVNKW2\x00" || salt || nonce || AES-256-GCM(key), magic as AAD
  v1:  salt || nonce || AES-256-GCM(key)                  (read-only)

v1 still opens so an existing deployment is not bricked, and reports itself so
the daemon can log a SECURITY line telling him to re-enroll. Nothing writes v1.
The magic is authenticated, so a v2 blob cannot be stripped and re-read as v1.

Four other defects on the same path:

  - The locked-boot store was opened on an IPC goroutine inside UnlockFn and
    never closed. Close is what re-encrypts the tmpfs working copy back over
    the ciphertext, so every write of a cold-started session was lost silently
    on the next boot. daemonLock now owns the store and seals it at shutdown.
  - MethodUnlock was reachable by anything on the box; the socket is same-uid
    and cannot authenticate its caller. It now requires a passkey assertion
    that mavweb verified first.
  - Concurrent unlocks would each open a store and wire a daemon. One at a
    time, and never a second one.
  - The hand-rolled HKDF keyed the expand step with the salt instead of the
    PRK. Replaced with crypto/hkdf.

Key wrapping moves from enrolment to the first assertion, because create() does
not produce a PRF result on most authenticators — only a support flag. An
authenticator without PRF now writes no wrapped file at all rather than one
that looks protected and is not, and the page says so.

Verified: make build, make test. New tests cover the v2 round trip, a wrong
secret, every single-bit tamper, truncation, the v1 downgrade attempt, legacy
v1 reads, non-32-byte and all-zero secrets, the ipc wire field, locked-mode
default-deny, a forged assertion never reaching the unlock path, seal-on-
shutdown after a cold start, and that nothing in the state dir contains the
plaintext key. The PRF round trip against real hardware is a QA step.

Vikunja #14

internal/ipc/api.go

@@ -729,17 +729,22 @@ type DayPlan struct {
 	Spoken string        `json:"spoken"`
 }
 
-// storeEncryptionKeyReq — passkey credential public key for wrapping the store
+// storeEncryptionKeyReq — the passkey-derived secret used to wrap the store
 // encryption key at enrollment time. Called by mavweb after RegisterFinish.
+//
+// Secret is the 32-byte WebAuthn PRF output, NOT the credential public key.
+// The field used to carry the public key and that was the bug: a public key
+// sits in passkeys.json next to the wrapped blob, so the blob protected
+// nothing. See internal/webauthn/keywrap.go.
 type storeEncryptionKeyReq struct {
-	PublicKey []byte `json:"public_key"`
+	Secret []byte `json:"secret"`
 }
 
-// unlockReq — passkey credential public key for unwrapping the store
-// encryption key at cold-start. mavend reads the wrapped blob from its own
-// configured path; the public key is the other half needed for unwrapping.
+// unlockReq — the passkey-derived secret for unwrapping the store encryption
+// key at cold-start. mavend reads the wrapped blob from its own configured
+// path; this is the other half. Same PRF-output contract as above.
 type unlockReq struct {
-	PublicKey []byte `json:"public_key"`
+	Secret []byte `json:"secret"`
 }
 
 // ErrToolNotFound — no tool row with this name (re-exported store sentinel for