Self-hosted Home: keys in the OS keystore, unlocked by the user's passkey #210

Part of #209 (user keys and private data that the host cannot read).

Today the device key (elastos/crates/elastos-identity/src/store.rs:264-292), the wallet keys (capsules/wallet-provider/src/storage.rs:340-369) and the Recovery Kit archive key (elastos/crates/elastos-server/src/auth.rs:3179-3208) are plain owner-only files in the Runtime data folder; the passkey only authenticates sign-in.

Done means

• The device and wallet keys live in the OS keystore (macOS Keychain or Secure Enclave; TPM or Secret Service on Linux where present), and data keys are released only after the user's passkey sign-in. Test: another OS user, and a copy of the disk or a backup, cannot decrypt user data or use a wallet key. Where the platform enforces user presence for key use, a same-user process cannot use the keys while Home is locked (test); where it cannot, the docs say so.
• docs/INSTALL.md states the limits plainly: platforms without a keystore or TPM, the Jetson, and that an unlocked Home holds keys in the Runtime's memory.
• Recovery Kit export and import work with the new key storage, and an existing Home migrates its keys once without data loss. Tests on macOS and Linux.
• Backups contain no plaintext keys. Test.