Password manager: restore from it, and key the credential by pubky

[jvsena42]

Closes #471.

What changed

The credential id is the pubky. It was the app's name, so two accounts saved from one device shared an entry and the read-back accepted whichever one came back under that name. The save and read-back effects now carry the account's full pubky. Entries saved before this keep the old id and are still accepted: the read-back asks for both ids, and the ViewModel decides by comparing the words, as it already did.

Restore from the password manager. The restore menu has a third card, restore_method_manager. It opens the phrase screen with the credential picker already raised. The phrase screen also offers the picker as a secondary button. What the picker returns goes through the existing phrase path (derive, look up, sign in), so every outcome is the one typed words get. A cancel or an empty provider leaves the field usable and says nothing came back.

Two details in the Android route:

• The on-entry picker is raised directly, not through the effect flow. An effect emitted as the screen opens was dropped before the collector subscribed and left the field locked. Found on the emulator.
• A rotation while the picker is up answers null, because the coroutine waiting on it is cancelled while the ViewModel survives.

Four new strings, in all eleven Android languages. iOS gets them in the next PR of the stack.

Verification

• ./gradlew :shared:jvmTest detektAll :androidApp:assembleDebug pass. New tests in RestorePhraseViewModelTest, BackupPhraseViewModelTest and a new BackupQuizViewModelTest.
• Pixel_9 emulator (API 37, no Google account, no credential provider), phone size, plus 2560x1600 and 1600x2560 via wm size for the two tablet width classes:
  • Restore menu shows three cards, centred in the column at both tablet sizes.
  • restore_method_manager raises the picker on entry, which returns NoCredentialException; the screen shows restore_phrase_manager_empty and the field is editable.
  • restore_phrase_from_manager raises it again. Rotating does not. Typing clears the note.
  • restore_method_phrase offers the button and raises nothing on entry.
  • On a signed-in local-key account, backup_phrase_save_manager fails with CreateCredentialNoCreateOptionException, shows backup_phrase_manager_failed, and the account stays un-backed-up.
• Not run: a save, read-back or restore that succeeds. No emulator here has a credential provider. journeys/28-password-manager-backup.xml is the script, and journeys/README.md lists it as undriven. Whether Google Password Manager honours allowedUserIds is also unverified; nothing depends on it.

The agent skill under plugins/loopky/ needs no change: nothing here touches CLI, import, card or deck logic.

🤖 Generated with Claude Code

[jvsena42]

One finding. The restore path, the pubky-keyed id, the legacy-id read and the eleven translations read correctly against the code.

[jvsena42]

Medium, already on main: a rotation while the save or read-back sheet is up locks this screen.

sheet is remember(context), so a configuration change restarts this LaunchedEffect and cancels the coroutine suspended in sheet.save / sheet.readBack. LeaveEffect skips onLeave on a configuration change, so the retained ViewModel keeps isSavingToPasswordManager = true: backup_phrase_save_manager stays disabled and neither the saved nor the failed line appears until the user leaves the screen.

BackupQuizScreen has the same shape with isChecking: onCheckSavedClick returns early while it is set, so backup_quiz_saved_check is dead after a rotation.

This PR fixes exactly this on the restore screen with answerFrom's finally. The same wrapper here would answer onPasswordManagerSaveResult(false) / onPasswordManagerReadBack(null) on cancellation.

[jvsena42]

Fixed in 6c65850. answerEvenIfCancelled in PasswordManagerSheet.kt delivers a fallback when the wait is cancelled, and the phrase, confirm and restore screens all use it. The ViewModels now ignore an answer nobody is waiting on, because the same fallback fires when the screen is left with the sheet up, after onLeave has reset the state; there is a test for that. Not driven: the emulator has no credential provider, so the sheet never stays up long enough to rotate under. Journey 28 has the step.