feat: encrypt OpenClaw device credentials

[rogerchappel]

Summary

• add a versioned per-runtime OpenClaw device credential envelope
• encrypt device tokens with the existing runtime-token keyring
• seal persisted Ed25519 private keys while retaining legacy plaintext read compatibility
• bind cached credentials to the expected device ID and approved scopes
• provide safe removal for browser-facing runtime metadata

Why

OpenClaw device tokens and private keys are durable authentication material. They must survive CrewCMD restarts without being stored or exposed as plaintext.

Stack

Depends on #705. This PR contains only the storage primitive; gateway-pool wiring follows in the next stacked PR.

Verification

• pnpm test -- src/lib/runtime-device-auth.test.ts
• pnpm exec tsc --noEmit --pretty false --incremental false
• pnpm exec eslint src/lib/runtime-device-auth.ts src/lib/runtime-device-auth.test.ts
• pre-push pnpm typecheck
• pre-push pnpm build
• git diff --check