perf(settings): write settings.json and wallets.json off the UI thread

Settings::save() and WalletIndex::save() ran the atomic write (temp
file, fsync, rename, directory fsync) on the UI thread: on every
preference change, and for wallets.json after every address-scan pass
whose wallet metadata changed, i.e. repeatedly during sync, when the
disk is busiest. Each took milliseconds to tens of milliseconds, and
seconds under heavy disk load.

The JSON is still built on the caller; the write is queued on an
App-owned CoalescingWriter, latest wins per file, one write at a time.

- After a fund- or security-critical setter (seed-migration stage,
  encryption pending, PIN enabled, active wallet file, wizard completed)
  the next save still waits until the file is on disk, so e.g. the
  sweep-submitted marker is durable before the sweep is broadcast. A
  failed durable save keeps the next one durable.
- Saves before the writer is attached (the upgrade re-save at startup),
  and in tests and tools, stay synchronous.
- main() flushes the queue (at most 3 s) before and after
  App::shutdown(), before the single-instance lock is released, so a
  relaunch never reads a stale settings.json.

A kill or power loss right after an ordinary save can now lose that
last preference change; the previous file stays intact. WalletIndex
saves report "queued" rather than "written" (no caller reads it). On a
wedged disk, exit can wait up to 2 x 3 s longer, inside the 15 s
watchdog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/config/settings.cpp

@@ -15,6 +15,7 @@
 #include <algorithm>
 #include <type_traits>
 
+#include "../util/coalescing_writer.h"
 #include "../util/logger.h"
 #include "../util/platform.h"
 
@@ -657,8 +658,13 @@ bool Settings::save(const std::string& path)
         // Atomic + durable: write to a temp file, fsync, then rename over the real file.
         // A crash mid-write can no longer truncate settings.json (which would silently
         // reset every preference on the next launch). Owner-only (0600) — it carries the
-        // lite-server list and address metadata.
-        return util::Platform::writeFileAtomically(path, j.dump(4), /*restrictPermissions=*/true);
+        // lite-server list and address metadata. With a writer attached the same atomic write
+        // runs on its background thread (queued, latest-wins); after a critical setter
+        // (durable_next_save_) this waits until the file is on disk, as the old save did.
+        const bool ok = util::persistFileAtomically(writer_, durable_next_save_, path, j.dump(4),
+                                                    /*restrictPermissions=*/true);
+        if (ok) durable_next_save_ = false;
+        return ok;
     } catch (const std::exception& e) {
         DEBUG_LOGF("Failed to save settings: %s\n", e.what());
         return false;