Refactor `blobs.rs` to accept generic `Connection` or `Transaction`

Context

In credential_vault/mod.rs, blobs::put(conn, ...) is called while an active transaction is open on the same connection. This works correctly in SQLite (same connection object), but it's confusing to readers since blobs.rs functions currently take a &Connection directly rather than a type that makes the transactional context explicit.

Proposed Refactor

Refactor blobs.rs (and similar helper modules) to accept a generic parameter — e.g. something implementing a Deref<Target = rusqlite::Connection> or a rusqlite::ToSql-style abstraction — so the same functions can be called with either a bare Connection or an active Transaction without ambiguity.

This would make call-sites like:

let tx = conn.transaction()?;
blobs::put(&tx, ...)?;   // clearly operating inside the transaction
tx.commit()?;

…unambiguous and self-documenting.

References

Flagged during review of #400. Not blocking that PR — tracking here for a follow-up refactor.

Start by reading credential_vault/mod.rs and blobs.rs, especially the blobs::put call made while a transaction is active. Identify similar helper modules that take &Connection, then make the refactor support both bare connections and transactions while keeping the transactional call site explicit; done means the relevant code builds and its existing behavior remains intact.