refactor(crypto): make system-wrapped DEKs the authoritative key path

DataCrypto and AuthManager now read keys through UserKeyManager: DEKs are
always unwrappable server-side, so the in-memory unlock session, DEK-in-JWT
wrapping, session-expiry data locks and ALLOW_APIKEY_DATA_UNLOCK are gone.
utils/user-crypto.ts is deleted; boot migration now cleans legacy wraps.
A one-release shim adopts DEKs from legacy dataKeyWrap tokens so active
password users migrate without re-login. Password login migrates legacy
password-wrapped DEKs via migratePasswordUserAtLogin.

src/backend/database/routes/user-webauthn-routes.ts

@@ -251,8 +251,6 @@ export function registerUserWebAuthnRoutes(
           (req.body?.response as RegistrationResponseJSON | undefined)?.response
             ?.transports ?? [];
 
-        await authManager.setupWebAuthnUserEncryption(userId);
-
         const name =
           typeof req.body?.name === "string" && req.body.name.trim()
             ? req.body.name.trim().slice(0, 80)