fix(security): require a fresh PIN or biometric check for sensitive actions

An unlocked phone was enough to read the 24-word recovery phrase. The
phrase, backup export and import, the duress PIN, a longer auto-lock,
turning off screen security, enabling biometrics and deleting the
account now ask for the PIN (or biometrics with biometricOnly) every
time. The duress session never shows the phrase. PIN checks outside the
lock screen count towards the same failure throttle.

app/lib/features/auth/change_pin_screen.dart

@@ -71,7 +71,14 @@ class _ChangePinScreenState extends ConsumerState<ChangePinScreen> {
     switch (_krok) {
       case _Krok.stary:
         setState(() => _pracuje = true);
-        final ok = await storage.verifyPin(_pin);
+        final bool ok;
+        try {
+          ok = await storage.verifyPin(_pin);
+        } on PinLockedException catch (e) {
+          if (!mounted) return;
+          _reset(context.l10n.pinLockedFor(e.remaining.inSeconds));
+          return;
+        }
         if (!mounted) return;
         if (!ok) {
           _reset(context.l10n.pinWrong);