test: cover high-risk crypto, restore, and CLI paths

[pmaxhogan]

Summary

Targeted high-risk test coverage (issue #40 scope: HIGH-RISK gaps + low-hanging
fruit, not a whole-codebase sweep).

I first mapped existing coverage. Contrary to the stale Explore notes,
driven-crypto content/key/filename/recovery, telemetry.rs, the
settings/accounts/restore command layer, and the CLI (main.rs, inspect.rs,
tests/cli.rs) are ALL already thoroughly unit-tested. To avoid padding with
duplicate asserts, I added tests only where there was a genuine, verified gap -
both in the highest-risk crate, driven-crypto:

1. keystore.rs had zero tests - the only crypto module with none. The OS
   keychain is not cleanly testable in-process (the keyring 4.1.2 mock store is
   not a declared dependency and a real round-trip is flaky on headless CI),
   which is exactly why the sibling driven-drive::token_store extracts its
   keyring-result -> domain mapping into pure free fns and tests those. I
   mirrored that established, CI-safe pattern: extracted map_load_secret /
   map_delete_result and unit-tested them - NoEntry -> NotFound, a
   non-32-byte secret -> MalformedKey(n) (empty / short / long), a valid
   32-byte secret -> the exact MasterKey, any other backend error ->
   Backend, and idempotent delete. No production behavior change: the methods
   delegate to the new pure fns with identical semantics.

2. End-to-end disaster-recovery chain (lib.rs suite_tests): master key
   -> wrap a per-source key -> persist the wrapped blob + the BIP39 phrase ->
   encrypt a file + path components -> drop the suite (model a wiped keychain)
   -> recover the master key from the phrase -> unwrap the SAME source key from
   the persisted blob -> decrypt the old ciphertext and filenames. This ties
   together recovery + key-wrapping + content STREAM + filename encryption,
   each of which was only unit-tested in isolation. A companion test asserts a
   different (valid) phrase fails to unwrap the source key (DecryptFailed).

Note on the title: the mandated PR title references restore/CLI paths, but
after auditing them I found both already well covered, so the net new tests
landed in crypto (the genuinely highest-risk, partially-untested surface).

Testing

All required Rust gates run from the worktree root with
CARGO_TARGET_DIR pointed at the warm shared target:

• cargo fmt --all -- --check - pass (exit 0)
• cargo build --workspace --all-targets - pass (exit 0)
• cargo clippy --workspace --all-targets -- -D warnings - pass (exit 0)
• cargo test --workspace - pass (28 test result: ok sections, 0 failed);
  driven-crypto now 41 passing tests (8 new). No #[ignore], no weakened
  tests.

No UI files were touched, so the UI gate set was not required.

Closes #40

🤖 Generated with Claude Code

https://claude.ai/code/session_01MZQh3ZfwtZsM6c5qnTuWZP

[github-actions]

Coverage

Area	main	this PR	delta
Rust (lib crates)	76.60%	76.71%	+0.11 (OK)
UI (vue/ts)	87.17%	87.17%	+0.00 (OK)

Gate: passed - no coverage regression (epsilon 0.1 pp).