PM-40520 - Move seal/unseal logic onto SealedOpenOrgInviteData

Per PR review, RegistrationClient methods were orchestrating the crypto
and constructing the sealed struct field-by-field, breaking encapsulation
of the domain type. Crypto now lives on SealedOpenOrgInviteData::seal /
::unseal; the client methods are thin FFI wrappers.

Also splits the module by concern:
- open_org_invite.rs  — domain types + crypto impls + round-trip tests
- serialization.rs    — wire encoding + WASM ABI + wire/parse tests
- client.rs           — FFI pair struct + thin RegistrationClient wrappers

SealedOpenOrgInviteData's envelope fields tightened from pub to pub(super)
since the client no longer needs field access. Folder renamed to
open_org_invite_crypto to satisfy clippy's module_inception check.

Wire format unchanged (pinned integration-test vector still passes).
Public API surface unchanged.

Author: JaredSnider-Bitwarden

crates/bitwarden-auth/src/registration/mod.rs

@@ -3,14 +3,14 @@
 //! mechanisms to establish their cryptographic state and register with
 //! the Bitwarden server
 
-mod open_org_invite;
+mod open_org_invite_crypto;
 mod post_keys_for_jit_password_registration;
 mod post_keys_for_key_connector_registration;
 mod post_keys_for_tde_registration;
 mod post_keys_for_user_password_registration;
 mod registration_client;
 
-pub use open_org_invite::{
+pub use open_org_invite_crypto::{
     OpenOrgInvite, SealedOpenOrgInvite, SealedOpenOrgInviteData, SealedOpenOrgInviteDataError,
 };
 pub use post_keys_for_jit_password_registration::{