feat(storage): per-app/owner/system encryption live: gatekeeper hands seed + fresh flag, storage unlocks layer, init seeds areas from factory/ (empties on new key); rmdir op; test-qemu checks sealed home + reboot persistence

crates/servers/storage-server/src/tests/server.rs

@@ -474,14 +474,19 @@ fn the_unbadged_holder_cannot_be_released() {
 }
 
 #[test]
-fn only_init_sets_the_key_and_only_once() {
+fn only_init_unlocks_and_only_once() {
     let mut s = server();
-    let set = |s: &mut Srv, badge, half| call(s, badge, StorageRequest::SetKey { half, words: [1, 2] }).0;
-    assert_eq!(set(&mut s, 5, 0), StorageResponse::Error, "a client cannot");
-    assert_eq!(set(&mut s, 0, 0), StorageResponse::Ok);
-    assert!(!s.unlocked());
-    assert_eq!(set(&mut s, 0, 0), StorageResponse::Error, "nor can it be replaced");
-    assert_eq!(set(&mut s, 0, 2), StorageResponse::Error, "two halves only");
-    assert_eq!(set(&mut s, 0, 1), StorageResponse::Ok);
+    let set = |s: &mut Srv, badge, req| call(s, badge, req).0;
+    let key = |half| StorageRequest::SetKey { half, words: [1, 2] };
+    let seed = |half| StorageRequest::SetSeed { half, words: [3, 4] };
+    assert_eq!(set(&mut s, 5, key(0)), StorageResponse::Error, "a client cannot");
+    assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Ok);
+    assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Error, "nor can a half be replaced");
+    assert_eq!(set(&mut s, 0, key(2)), StorageResponse::Error, "two halves only");
+    assert_eq!(set(&mut s, 0, key(1)), StorageResponse::Ok);
+    assert_eq!(set(&mut s, 0, seed(0)), StorageResponse::Ok);
+    assert!(!s.unlocked(), "not without the whole seed");
+    assert_eq!(set(&mut s, 0, seed(1)), StorageResponse::Ok);
     assert!(s.unlocked());
+    assert_eq!(set(&mut s, 0, key(0)), StorageResponse::Error, "once unlocked, never again");
 }