feat: allow host-selected backup scratch directories

[Dzejkop]

WalletKit's byte-based backup APIs use a plaintext SQLite scratch file under worldid/. Mobile hosts cannot currently select their platform temporary/cache directory, so a process kill can leave plaintext in persistent app storage.

Add native UniFFI methods export_vault_for_backup_in_directory(temp_dir) and import_vault_from_backup_in_directory(backup_bytes, temp_dir). They use an existing absolute host-selected directory, reserve a unique owner-only file, and clean it up on success or error. Missing/unusable directories fail without falling back to persistent storage. Calls never sweep other files in the chosen directory, so stores can share an app cache directory. After abrupt termination the host/OS owns leftover-file cleanup.

For example, Kotlin callers can pass context.cacheDir.absolutePath to exportVaultForBackupInDirectory(...); Swift callers can pass their injected filesystem's temporary-directory path to exportVaultForBackupInDirectory(tempDir: ...). Restore uses the matching directory-specific import method.

Existing APIs remain available for current consumers; mobile apps must adopt the new methods to change placement. Exported bytes and the vault schema remain unchanged. This controls WalletKit's internal scratch file; each app still owns its separate Bedrock backup staging policy.

Closes #280

Validation: all 29 credential-storage unit tests pass, including byte-compatible roundtrip, file permissions/directory placement, error cleanup, shared-directory isolation, and invalid directory handling. Strict Clippy (cargo clippy -p walletkit-core --lib --tests -- -D warnings), formatting, and git diff --check pass. Full workspace and generated foreign-binding validation is running in CI.