perf(settings): write settings.json and wallets.json off the UI thread

Settings::save() and WalletIndex::save() ran the atomic write (temp
file, fsync, rename, directory fsync) on the UI thread: on every
preference change, and for wallets.json after every address-scan pass
whose wallet metadata changed, i.e. repeatedly during sync, when the
disk is busiest. Each took milliseconds to tens of milliseconds, and
seconds under heavy disk load.

The JSON is still built on the caller; the write is queued on an
App-owned CoalescingWriter, latest wins per file, one write at a time.

- After a fund- or security-critical setter (seed-migration stage,
  encryption pending, PIN enabled, active wallet file, wizard completed)
  the next save still waits until the file is on disk, so e.g. the
  sweep-submitted marker is durable before the sweep is broadcast. A
  failed durable save keeps the next one durable.
- Saves before the writer is attached (the upgrade re-save at startup),
  and in tests and tools, stay synchronous.
- main() flushes the queue (at most 3 s) before and after
  App::shutdown(), before the single-instance lock is released, so a
  relaunch never reads a stale settings.json.

A kill or power loss right after an ordinary save can now lose that
last preference change; the previous file stays intact. WalletIndex
saves report "queued" rather than "written" (no caller reads it). On a
wedged disk, exit can wait up to 2 x 3 s longer, inside the 15 s
watchdog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main.cpp

@@ -2357,8 +2357,14 @@ int main(int argc, char* argv[])
         _Exit(0);
     }).detach();
 
+    // Land the queued settings/wallets.json writes (incl. the window size saved above) before the joins
+    // in shutdown(); bounded (3 s) so a wedged disk can't eat the watchdog's budget.
+    app.flushPendingWrites();
     // Final cleanup (daemon already stopped by beginShutdown)
     app.shutdown();
+    // shutdown()'s fallback branch saves settings again; land that too, BEFORE the single-instance lock
+    // is released below so a relaunch can't read a stale settings.json. _Exit() skips ~App().
+    app.flushPendingWrites();
 #ifdef DRAGONX_USE_DX11
     Shutdown(window, dx);
 #else