[auth] Add "Lock this device" control to re-lock a kept-unlocked session (#51)

The opt-in "keep unlocked" cache had no user-facing way to undo it mid-session
(it cleared only on logout / clear-site-data). Add a "Lock this device" button to
the profile modal footer (desktop + mobile), shown only when the active account
has a cached key to forget (app.isSessionKeptUnlocked -> client.hasCachedUnlockedKey).

Clicking it runs app.lockKeptUnlockedSession(pubkey), which re-locks in one action
everything the signer unlocks:
  - forgets the cached key (both tiers) so future reloads re-prompt for the PIN,
  - drops the in-memory signer (logoutSigner) so the CURRENT session re-locks now
    (the next signing action prompts again via ensureEncryptionCapableSigner),
  - storageService.lock(pubkey), and
  - nwcSettingsService.clearCache() (re-hydrates from the signer next time).

Visibility refreshes on renderSavedProfiles + selectPane. Tests: 2 in
tests/profile-modal-controller.test.mjs (shown only when kept-unlocked; click locks
the active pubkey). Lint + build green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

js/ui/applicationBootstrap.js

@@ -577,6 +577,10 @@ export default class ApplicationBootstrap {
           // re-unlock it instead of dead-ending with a blanket error (TODO #57).
           ensureEncryptionCapableSigner: (options = {}) =>
             app.ensureEncryptionCapableSigner(options),
+          // "Keep unlocked" lock controls (TODO #51).
+          isSessionKeptUnlocked: (pubkey) => app.isSessionKeptUnlocked(pubkey),
+          lockKeptUnlockedSession: (pubkey) =>
+            app.lockKeptUnlockedSession(pubkey),
           hashtagPreferences: app.hashtagPreferences,
           getHashtagPreferences: () => app.getHashtagPreferences(),
           describeHashtagPreferencesError: (error, fallbackMessage) =>