fix(android): contain setup errors and cancel invalidated passkey work

[OskarEichler]

Fixes

• Construct CredentialManager and create/get request objects inside the coroutine's existing try/catch, so setup/JSON validation failures reject the promise instead of escaping the bridge method.
• Put Signal API JSON construction in the same protected scope.
• Cancel the module's coroutine scope from invalidate; rethrow coroutine cancellation rather than reporting it to a disposed React instance as an ordinary provider error.

Public signatures, successful payloads, provider-specific error mapping and authenticator flags are unchanged. Setup failures now reject through the existing error paths. Module teardown cancels outstanding work; no stale completion is promised after teardown.

Verification

The combined reviewed changes pass all 30 existing JS tests, TypeScript, full lint, package builds and whitespace checks. No tests were written or changed. Native consumer checks on RN 0.87.1 pass: both Android Debug flavors, both iOS simulator Debug schemes, and all four release-mode Metro bundles. Existing JS tests mock the native module: they are not proof of real Credential Manager/provider behavior, and no live credential creation/get/Signal API operation was performed.