refactor: own CredentialStore from PersonalizationApplet instance

Prepares for AMD-H by moving the singleton's anchor off a static field
onto the PersonalizationApplet instance. The static INSTANCE remains
solely as an in-package publish-point so AliroApplet/StepUpApplet keep
working unchanged.

Adds CredentialStore.bootstrap() (called from PersonalizationApplet's
constructor) and CredentialStore.republish() (reserved for the upcoming
onRestore hook). Drops the lazy-init path in get() — every install path
now goes through PersonalizationApplet first, so INSTANCE is always set
by the time AliroApplet looks it up. Test setUps that previously called
CredentialStore.get().resetForTesting() before the applet was installed
are reordered or dropped: each test now gets a fresh store via the
constructor's bootstrap() call.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

applet/src/test/java/com/dangerousthings/aliro/AliroAppletAuth1Test.java

@@ -30,7 +30,9 @@ class AliroAppletAuth1Test {
 
     @BeforeEach
     void setUp() {
-        CredentialStore.get().resetForTesting();
+        // reader.provision() below installs PersonalizationApplet, whose
+        // constructor calls CredentialStore.bootstrap() and gives us a fresh
+        // store for every test — no explicit reset needed any more.
         sim = new CardSimulator();
         AID expeditedAid = new AID(AliroAids.EXPEDITED, (short) 0, (byte) AliroAids.EXPEDITED.length);
         sim.installApplet(expeditedAid, AliroApplet.class);