feat(account): change the master password with device verification (#629)

[kipavy]

Closes #629.

On a signed-in device, the Change master password dialog now offers "Forgot it? Confirm with {method} instead" under the current-password field. The method is Windows Hello, Touch ID or your Mac password, your system password, or your fingerprint or screen lock.

The device already keeps the master password in the OS keychain. After the OS confirms the user, that stored password stands in for the typed one:

• A plain secret needs a system_auth_verify first.
• A sealed secret (Android, bound) shows its own prompt.

The server still checks the old auth key and the second factor.

Behaviour

• The option only appears when the device can show an OS prompt (system_auth_available) or the secret is sealed. Without one, an unlocked device alone is not enough to take over the account, so the typed path is the only option.
• Success. The current-password field is replaced by "Confirmed on this device".
• Signed out elsewhere. Before any prompt, the dialog refreshes the session. A password changed on another device has already revoked it, even while the access token is still valid. The dialog then says to sign in again with the new password, instead of sending the stale stored one. An unreachable server does not block the check.
• Cancel. Nothing changes.
• Any other failure. "This device could not confirm it's you. Type your current password instead."
• Refactor. readPasswordWithSystemAuth is shared with unlockWithSystemAuth, which now uses it.
• Strings in all 6 locales.
• Email notice. The owner gets an email on every password change: feat(auth): email the account owner when the master password changes server#112.

Depends on

#640 (merged), which fixes the identity and stranded-vault bugs a password change used to cause on linked accounts.

Tests

• ChangeMasterPasswordModal.test.tsx (6 cases):
  • device verification replaces the current password;
  • cancel keeps the typed field without an error;
  • failure shows the message;
  • no option without an OS prompt;
  • a revoked session is caught before any prompt;
  • an unreachable server does not block the check.
• vaultBinding.test.ts covers plain with verify, declined, sealed, and nothing stored.
• 163 tests pass across the touched files after the rebase. tsc is clean.

Screenshots

Captured from a real build against a local test server. Shared with the maintainer separately (private artifact):

• before;
• after (default);
• confirmed;
• failure;
• mobile layout.