feat(pin): invalidate persistent tokens on rejection and PIN change (4/5)

[AlfioEmanueleFresta]

Part 4 of 5 in a stack: #231, #232, #233, #234 (this), #235

This stack adds support for persistent pinUvAuthTokens (the CTAP 2.2+ pcmr permission), so a credential manager can list passkeys without re-prompting for the PIN on every launch or replug. Read-only credential management only.

This PR

Keeps stored tokens fresh:

• If an authenticator rejects a stored token, it is evicted and a new one is minted transparently.
• A local PIN change drops the stored token for that authenticator.
• At mint time, a superseded token for the same device is cleaned up, while tokens belonging to other keys are left untouched.