Best practise for encryption in a password manager
If the key is derived from the password there is no reason to store it anywhere.
The main problem in your outline is not the cryptography.
You are explicitly writing the passwords to disk. This is a really bad idea. The deletion may not happen at all, e.g powe failure. Even if it does on a modern hard drive it is really hard to overwrite data it won't actually be written to the same place and thus traces of previous data may remain.
A secure implementation will not only avoid writing to disk it would explicitly request from the OS to not swap out the sensitive memory parts. The OS may allow you to do this for only a small piece of memory. If the password DB is large decrypting the whole thing may be problematic and you should consider only decrypting the part you want but that causes a behaviour change you may or not want.
You may want an authentication if you worry about someone mangling your db.
You didn't mention IV selection, needs to be from a strong random source and replaced everytime you change anything and need to reencrypt.