feat(pin): acquire and reuse persistent tokens via encIdentifier recognition (3/5)

[AlfioEmanueleFresta]

Part 3 of 5 in a stack: #231, #232, #233 (this), #234, #235

This stack adds support for persistent pinUvAuthTokens (the CTAP 2.2+ pcmr permission), so a credential manager can list passkeys without re-prompting for the PIN on every launch or replug. Read-only credential management only.

This PR

The behavioural core:

• Read-only credential management now requests a persistent token when the authenticator advertises support and a store is configured. Writes keep using the ordinary token.
• Recognises a previously seen authenticator and reuses its stored token, so no PIN prompt is needed.
• When nothing matches, it mints a new token and stores it for next time. Persistent tokens are kept out of the ordinary in-session cache.