cold-start unlock: key wrap/unwrap, locked-mode daemon, IPC unlock methods

- internal/webauthn/keywrap.go: HKDF-SHA256 + AES-256-GCM WrapKey/UnwrapKey
- internal/ipc/: MethodStoreEncryptionKey/MethodUnlock wire, api structs,
  server dispatch callbacks (WrapKeyFn/UnlockFn), client stubs
- internal/config/config.go: DefaultWrappedKeyPath() method
- cmd/mavend/main.go: locked-mode boot path - detects wrapped key, starts
  locked with lockedAPI stub, wires UnlockFn that opens store + replaces
  CoreAPI on passkey assertion. env-key path stores WrapKeyFn for enrollment.
  make test green (303+, -race)

internal/ipc/server.go

@@ -302,10 +302,29 @@ type Server struct {
 	// MethodAssertStepUp returns ErrUnknownMethod (same as pre-stepup floor).
 	StepUp StepUpFunc
 
+	// WrapKeyFn — wraps the in-memory store encryption key with a passkey
+	// credential public key (HKDF-AESGCM) and writes the wrapped blob to disk.
+	// Set by the daemon; nil ⇒ MethodStoreEncryptionKey returns ErrUnknownMethod.
+	WrapKeyFn WrapKeyFunc
+
+	// UnlockFn — unwraps the store encryption key from the wrapped blob using
+	// the passkey credential public key, opens the encrypted store, and wires
+	// the rest of the daemon (voice, loop, delivery). Set by the daemon when
+	// in locked mode; nil ⇒ MethodUnlock returns ErrUnknownMethod.
+	UnlockFn UnlockFunc
+
 	// now is injected so tests can drive time; the loop already works in
 	// absolute ts supplied by callers, so this isn't load-bearing for live ops.
 }
 
+// WrapKeyFunc — wraps the store encryption key with the given credential
+// public key and persists the wrapped blob.
+type WrapKeyFunc func(ctx context.Context, publicKey []byte) error
+
+// UnlockFunc — unwraps the store encryption key using the given credential
+// public key and completes daemon initialization.
+type UnlockFunc func(ctx context.Context, publicKey []byte) error
+
 // CheckFunc — the auth hook signature. Wired by the daemon (auth.Gate.Check
 // satisfies this); dispatch calls it once per request after param-unmarshal
 // independence (it gets the raw params, may unmarshal what it needs — ipc
@@ -672,6 +691,26 @@ func (s *Server) dispatch(ctx context.Context, req Request) (json.RawMessage, er
 		}
 		return nil, fmt.Errorf("%w: %s", ErrUnknownMethod, req.Method)
 
+	case MethodStoreEncryptionKey:
+		if s.WrapKeyFn != nil {
+			var p storeEncryptionKeyReq
+			if err := unmarshalParams(req.Params, &p); err != nil {
+				return nil, err
+			}
+			return marshalResult(nil), s.WrapKeyFn(ctx, p.PublicKey)
+		}
+		return nil, fmt.Errorf("%w: %s", ErrUnknownMethod, req.Method)
+
+	case MethodUnlock:
+		if s.UnlockFn != nil {
+			var p unlockReq
+			if err := unmarshalParams(req.Params, &p); err != nil {
+				return nil, err
+			}
+			return marshalResult(nil), s.UnlockFn(ctx, p.PublicKey)
+		}
+		return nil, fmt.Errorf("%w: %s", ErrUnknownMethod, req.Method)
+
 	default:
 		return nil, fmt.Errorf("%w: %s", ErrUnknownMethod, req.Method)
 	}
@@ -713,6 +752,12 @@ func (s *Server) Close() error {
 // Path returns the filesystem path of the listening socket.
 func (s *Server) Path() string { return s.path }
 
+// SetAPI atomically replaces the CoreAPI the server dispatches to. Used by
+// the daemon's unlock path: in locked mode a dummy API returns errors for all
+// store methods; after unlock, the real store API is swapped in. Safe to call
+// while the server is serving (dispatch reads s.api once per request).
+func (s *Server) SetAPI(api CoreAPI) { s.api = api }
+
 func parentDir(p string) string {
 	if i := lastIndexByte(p, '/'); i >= 0 {
 		if i == 0 {