Defer backend boot past the double-invoke, cancel superseded vault init,
gate start on vault hydration, and harden hotkey/attach cleanup so the
first connect no longer races a stale close or empty keychain.
Co-authored-by: 陈大猫 <binaricat@users.noreply.github.com>