Persist engine mounts across seal/unseal cycles

- Add Registry.UnsealAll() that rediscovers mounted engines from the
  barrier on unseal, using stored metadata at engine/_mounts/ with a
  fallback discovery scan for pre-existing mounts (migration path)
- Registry.Mount() now persists mount metadata to the barrier;
  Registry.Unmount() cleans it up
- Call UnsealAll() from both REST and web unseal handlers
- Change Unmount() signature to accept context.Context
- Default CA key size changed from P-384 to P-521
- Add build-time version stamp via ldflags; display in dashboard status bar
- Make metacrypt target .PHONY so make devserver always rebuilds
- Redirect /pki to /dashboard when no CA engine is mounted

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/templates/dashboard.html

@@ -5,6 +5,7 @@
     <span>Logged in as <strong>{{.Username}}</strong></span>
     {{if .IsAdmin}}<span class="badge">Admin</span>{{end}}
     <span>State: <strong>{{.State}}</strong></span>
+    <span class="version">v{{.Version}}</span>
     <a href="/login" onclick="fetch('/v1/auth/logout',{method:'POST'})">Logout</a>
 </div>