perf(settings): write settings.json and wallets.json off the UI thread

Settings::save() and WalletIndex::save() ran the atomic write (temp
file, fsync, rename, directory fsync) on the UI thread: on every
preference change, and for wallets.json after every address-scan pass
whose wallet metadata changed, i.e. repeatedly during sync, when the
disk is busiest. Each took milliseconds to tens of milliseconds, and
seconds under heavy disk load.

The JSON is still built on the caller; the write is queued on an
App-owned CoalescingWriter, latest wins per file, one write at a time.

- After a fund- or security-critical setter (seed-migration stage,
  encryption pending, PIN enabled, active wallet file, wizard completed)
  the next save still waits until the file is on disk, so e.g. the
  sweep-submitted marker is durable before the sweep is broadcast. A
  failed durable save keeps the next one durable.
- Saves before the writer is attached (the upgrade re-save at startup),
  and in tests and tools, stay synchronous.
- main() flushes the queue (at most 3 s) before and after
  App::shutdown(), before the single-instance lock is released, so a
  relaunch never reads a stale settings.json.

A kill or power loss right after an ordinary save can now lose that
last preference change; the previous file stays intact. WalletIndex
saves report "queued" rather than "written" (no caller reads it). On a
wedged disk, exit can wait up to 2 x 3 s longer, inside the 15 s
watchdog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app.h

@@ -36,6 +36,7 @@
 #include "services/wallet_security_controller.h"
 #include "services/wallet_security_workflow.h"
 #include "util/async_task_manager.h"
+#include "util/coalescing_writer.h"
 #include "util/fetch_backoff.h"
 #include "util/pool_stats_service.h"
 #include "wallet/wallet_capabilities.h"
@@ -161,6 +162,12 @@ public:
      */
     void shutdown();
 
+    /**
+     * @brief Wait (bounded, 3 s) for queued settings.json / wallets.json writes to land on disk.
+     * main() calls it around shutdown(): _Exit() skips ~App(), so nothing else would.
+     */
+    void flushPendingWrites() { file_writer_.flush(std::chrono::milliseconds(3000)); }
+
     /**
      * @brief Check if app should exit (render loop can stop)
      * Enforces minimum 1-second display of shutdown screen so user sees feedback.
@@ -871,6 +878,7 @@ private:
     // Saved connection credentials (needed to open the fast-lane connection)
     rpc::ConnectionConfig saved_config_;
 
+    util::CoalescingWriter file_writer_;   // background atomic writer for settings.json / wallets.json
     std::unique_ptr<config::Settings> settings_;
     std::unique_ptr<wallet::LiteWalletController> lite_wallet_;  // lite builds w/ linked backend
     // Pending send_tab callback for an in-flight lite send (delivered in update() once the