propagate db errors through vault DbAccess trait

[fabracht]

Summary

Closes #38. DbAccess::read_entity now returns Result<Option<Value>, Error> and update_entity returns Result<Value, Error>; the standalone _db and _mqtt helpers + Database/MqttDbAccess/NoopDbAccess impls match. All callers handle the error explicitly:

• Password change / reset submit: critical updates return Response::error(Internal, ...) on failure instead of silent success; best-effort cleanup updates (marking challenges expired/failed/verified) log warn! and continue.
• Vault admin ops (enable/unlock/disable/change/status): identity reads and migration state transitions surface failures as VaultError::Internal instead of fire-and-forget.
• resume_pending_migration and batch encrypt/decrypt log per-record failures with warn!.

Test plan

• cargo make clippy clean
• cargo make format-check clean
• cargo test --workspace --exclude mqdb-wasm — 1013 pass (incl. backend_integration 11/11, constraint_test 34/34, cluster lib 479/479)