unwrap_dek(
slots,ed25519_seed,ed25519_pk) ->dek,err
Unwrap a DEK from key slots using an Ed25519 seed
Finds the key slot matching the given public key's fingerprint, then reverses the ECDH + HKDF + ChaCha20-Poly1305 wrapping to recover the DEK. Returns a secure mlock'd userdata holding the DEK, or nil and an error if no matching slot is found or decryption fails.