fix(app): what a password unlocked is wiped once done with

The reading of the full reading's fixes noted that the main isolate's
copies of SRP's x and the key-encryption key, Dart's own bytes, stayed
for as long as the sign-in sheet's cubit lived, and after every change's
proof.

PasswordUnlock.forget zeroes them: the sign-in cubit wipes what the
password unlocked once signed in, once another password replaced it, and
as it closes; a change's or deletion's proof wipes what it unlocked once
its answer is made. The fake crypto's proof copies its bytes, as a real
one is new bytes. halkyon_keys' README says what is wiped and what isn't.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_keys/README.md

@@ -33,13 +33,15 @@ What leaves guarded memory, exactly:
   keys straight from guarded memory into the one buffer libsodium encrypts, wiped
   right after; opening them, the decrypted buffer, wiped once its keys are copied
   into guarded memory; a phrase's entropy once its key is derived; the seed checked
-  against a signing key (disposed).
+  against a signing key (disposed); and on the device (halkyon_app) the main
+  isolate's bytes of x and the key-encryption key (`PasswordUnlock.forget`) once
+  the sign-in is done, another password replaced them, its sheet closed, or a
+  change's or deletion's proof was made.
 - **Not wiped, as Dart can't:** SRP's x as a `BigInt` (immutable, gone when the
   garbage collector takes it); the password and the phrase as typed (`String`s);
-  and on the device (halkyon_app) the bytes of x and the key-encryption key a
-  sign-in carries between its isolates while a code is typed, and the unlocked
-  keys as the keyring returns them (base64 `String`s). Isolates copy what they
-  send each other, so each holds a copy of its own.
+  the copies of x and the key-encryption key that crossed between isolates (each
+  isolate holds its own, gone with it); and the unlocked keys as the keyring
+  returns them (base64 `String`s).
 
 ## What never leaves the device