feat(machine): seed + bunker-binding IPC bridge

get-atm-secrets now returns { spireSeed, bunkerBinding } instead of the raw
nsec (one-shot semantics kept). Adds IPC handlers + preload bindings for
saveBunkerBinding / clearBunkerBinding / resetBootstrapGate so the renderer
can persist a pairing and re-arm the cassette-state hello on re-pair (#56).
resetBootstrapGate added to state-store. Types mirrored in electron.d.ts.

Part of Phase C, aiolabs/bitspire#52.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/machine/electron/state-store.ts

@@ -483,6 +483,16 @@ export function clearBunkerBinding(): void {
   db.prepare('DELETE FROM bunker_binding WHERE id = 1').run()
 }
 
+/**
+ * Reset the bootstrap-publish gate so the ATM re-publishes its
+ * `bitspire-cassettes-state` hello-event. Called on a re-pair (new seed) so
+ * the new operator receives the spire's current state (aiolabs/bitspire#56).
+ */
+export function resetBootstrapGate(): void {
+  if (!db) throw new Error('Database not initialized')
+  db.prepare('UPDATE meta SET value = ? WHERE key = ?').run('', 'bootstrapPublishedAt')
+}
+
 export type OperatorCassettesPayload = {
   positions: Record<string, { denomination: number; count: number }>
 }