fix(app): what a password unlocked is wiped once done with

The reading of the full reading's fixes noted that the main isolate's
copies of SRP's x and the key-encryption key, Dart's own bytes, stayed
for as long as the sign-in sheet's cubit lived, and after every change's
proof.

PasswordUnlock.forget zeroes them: the sign-in cubit wipes what the
password unlocked once signed in, once another password replaced it, and
as it closes; a change's or deletion's proof wipes what it unlocked once
its answer is made. The fake crypto's proof copies its bytes, as a real
one is new bytes. halkyon_keys' README says what is wiped and what isn't.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_app/test/password/data/password_unlock_test.dart

@@ -0,0 +1,24 @@
+import 'dart:typed_data';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:halkyon_app/halkyon_app.dart';
+import 'package:halkyon_base_client/halkyon_base_client.dart' as protocol;
+
+void main() {
+  test("forgetting what a password unlocked zeroes SRP's x and the "
+      'key-encryption key (the reading of the fixes)', () {
+    final unlock = PasswordUnlock(
+      salt: Uint8List(16),
+      costs: protocol.PasswordCosts(
+        algorithm: 'argon2id13',
+        opsLimit: 3,
+        memLimit: 64 * 1024 * 1024,
+      ),
+      srpSecret: Uint8List.fromList(List.filled(32, 7)),
+      keyEncryptionKey: Uint8List.fromList(List.filled(32, 9)),
+    )..forget();
+
+    expect(unlock.srpSecret, everyElement(0));
+    expect(unlock.keyEncryptionKey, everyElement(0));
+  });
+}