cold-start unlock: key wrap/unwrap, locked-mode daemon, IPC unlock methods

- internal/webauthn/keywrap.go: HKDF-SHA256 + AES-256-GCM WrapKey/UnwrapKey
- internal/ipc/: MethodStoreEncryptionKey/MethodUnlock wire, api structs,
  server dispatch callbacks (WrapKeyFn/UnlockFn), client stubs
- internal/config/config.go: DefaultWrappedKeyPath() method
- cmd/mavend/main.go: locked-mode boot path - detects wrapped key, starts
  locked with lockedAPI stub, wires UnlockFn that opens store + replaces
  CoreAPI on passkey assertion. env-key path stores WrapKeyFn for enrollment.
  make test green (303+, -race)

internal/config/config.go

@@ -451,6 +451,14 @@ func (c *Config) DBEncryptionKey() ([]byte, error) {
 	return key, nil
 }
 
+// DefaultWrappedKeyPath returns the conventional path for the wrapped
+// encryption key blob — alongside the StateDir. This is the path checked
+// automatically when --wrapped-key-file is not provided on the command line.
+// The caller may always override via the flag.
+func (c *Config) DefaultWrappedKeyPath() string {
+	return filepath.Join(c.StateDir, "db_key.wrapped")
+}
+
 func defaultDataDir() string {
 	if x := os.Getenv("XDG_DATA_HOME"); x != "" {
 		return filepath.Join(x, "maven")