fix(vault): read the unseal threshold from the recorded split parameters

server/crates/arbiter-server/migrations/2026-02-14-171124-0000_init/up.sql

@@ -37,7 +37,11 @@ create table if not exists tls_history (
 create table if not exists arbiter_settings (
     id INTEGER not null PRIMARY KEY CHECK (id = 1), -- singleton row, id must be 1
     root_key_id integer references root_key_history (id) on delete RESTRICT, -- if null, means wasn't bootstrapped yet
-    tls_id integer references tls_history (id) on delete RESTRICT
+    tls_id integer references tls_history (id) on delete RESTRICT,
+    -- Shamir threshold of the split that produced the stored shares. Null before bootstrap.
+    -- Recorded rather than recomputed: an aborted operator replacement leaves fewer share
+    -- rows than the split has shares, and a recomputed threshold would then be wrong.
+    shamir_threshold integer
 ) STRICT;
 
 insert into arbiter_settings (id) values (1) on conflict do nothing;