Persist engine mounts across seal/unseal cycles

- Add Registry.UnsealAll() that rediscovers mounted engines from the
  barrier on unseal, using stored metadata at engine/_mounts/ with a
  fallback discovery scan for pre-existing mounts (migration path)
- Registry.Mount() now persists mount metadata to the barrier;
  Registry.Unmount() cleans it up
- Call UnsealAll() from both REST and web unseal handlers
- Change Unmount() signature to accept context.Context
- Default CA key size changed from P-384 to P-521
- Add build-time version stamp via ldflags; display in dashboard status bar
- Make metacrypt target .PHONY so make devserver always rebuilds
- Redirect /pki to /dashboard when no CA engine is mounted

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/engine/engine_test.go

@@ -62,7 +62,7 @@ func TestRegistryMountUnmount(t *testing.T) {
 		t.Fatalf("expected ErrMountExists, got: %v", err)
 	}
 
-	if err := reg.Unmount("default"); err != nil {
+	if err := reg.Unmount(ctx, "default"); err != nil {
 		t.Fatalf("Unmount: %v", err)
 	}
 
@@ -74,7 +74,7 @@ func TestRegistryMountUnmount(t *testing.T) {
 
 func TestRegistryUnmountNotFound(t *testing.T) {
 	reg := NewRegistry(&mockBarrier{})
-	if err := reg.Unmount("nonexistent"); err != ErrMountNotFound {
+	if err := reg.Unmount(context.Background(), "nonexistent"); err != ErrMountNotFound {
 		t.Fatalf("expected ErrMountNotFound, got: %v", err)
 	}
 }