The first start after the schema 165 upgrade takes the legacy password pins before it reads the server list, so saved passwords keep working

[erikdarlingdata]

Fixes #5455.

Why

On the first start after the schema 165 upgrade, the service read the server list before it took the pins for saved old-format passwords. The view reads the pins, found none, and built every server with no pin. The pin snapshot ran about 40 lines later but does not bump the config version, so no reload followed. Every server whose saved password darling.json does not declare stayed down for the whole run. On two production stores, 24 of 42 servers and 49 of 50 targets did not collect until a second restart, which found the pins.

What changes

• DarlingWorker.ExecuteAsync now starts the password key runtime (key load and legacy pin snapshot) after SeedIfEmptyAsync and before the first LoadViewAsync. It is still after migrations and role provisioning, and after the seed so seeded rows are pinned. The comment at the call site says why.
• I built the move, not the reload fallback. StartForServiceAsync reads only config.Postgres (through the key directory choice), and ApplyToConfig writes none of the Postgres settings, so the start does not depend on anything the view changes.
• No migration, no change to the pin or seal logic.

Test plan

• Source-order test: the key start comes after SeedIfEmptyAsync( and before the first LoadViewAsync(. RED on dev's order (failed there), green here.
• Live test on a scratch store with legacy rows darling.json does not declare: pins first, then the view gives non-null pins and a "enter again" count of 0. With the old order the same rows have no pin and the count is 3.
• DarlingPasswordKeyRuntimeTests and DarlingPasswordKeyStoreLiveTests: 27 passed.
• Full Darling.Tests on a Mac: 27514 total, 612 failed, all from Windows-only WPF/PresentationCore loads, the viewer classes, deploy script and a few others that need Windows. None are in the password, pin, store config or startup classes. The collection hygiene test cannot load on a Mac; the new live test sits in a class that already carries its own-store comment.

CHANGELOG entry

SECTION: Fixed

• Saved passwords keep working on the first start after the schema 165 upgrade ([#PR]) - the service now takes the legacy password pins before it reads the server list, so servers with saved old-format passwords connect on that first start instead of waiting for a second restart.