Persist engine mounts across seal/unseal cycles

- Add Registry.UnsealAll() that rediscovers mounted engines from the
  barrier on unseal, using stored metadata at engine/_mounts/ with a
  fallback discovery scan for pre-existing mounts (migration path)
- Registry.Mount() now persists mount metadata to the barrier;
  Registry.Unmount() cleans it up
- Call UnsealAll() from both REST and web unseal handlers
- Change Unmount() signature to accept context.Context
- Default CA key size changed from P-384 to P-521
- Add build-time version stamp via ldflags; display in dashboard status bar
- Make metacrypt target .PHONY so make devserver always rebuilds
- Redirect /pki to /dashboard when no CA engine is mounted

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/metacrypt/main.go

@@ -6,6 +6,9 @@ import (
 	"os"
 )
 
+// version is set at build time via -ldflags "-X main.version=<value>".
+var version = "dev"
+
 func main() {
 	if err := rootCmd.Execute(); err != nil {
 		fmt.Fprintln(os.Stderr, err)

cmd/metacrypt/server.go

@@ -74,7 +74,7 @@ func runServer(cmd *cobra.Command, args []string) error {
 	engineRegistry := engine.NewRegistry(b)
 	engineRegistry.RegisterFactory(engine.EngineTypeCA, ca.NewCAEngine)
 
-	srv := server.New(cfg, sealMgr, authenticator, policyEngine, engineRegistry, logger)
+	srv := server.New(cfg, sealMgr, authenticator, policyEngine, engineRegistry, logger, version)
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()