fix(security): require a fresh PIN or biometric check for sensitive actions

An unlocked phone was enough to read the 24-word recovery phrase. The
phrase, backup export and import, the duress PIN, a longer auto-lock,
turning off screen security, enabling biometrics and deleting the
account now ask for the PIN (or biometrics with biometricOnly) every
time. The duress session never shows the phrase. PIN checks outside the
lock screen count towards the same failure throttle.

app/lib/features/settings/biometrics_tile.dart

@@ -12,6 +12,7 @@ import 'package:local_auth/local_auth.dart';
 import 'package:sepot/core/l10n/error_messages.dart';
 import 'package:sepot/core/l10n/l10n.dart';
 import 'package:sepot/core/theme/app_theme.dart';
+import 'package:sepot/features/auth/reauth.dart';
 import 'package:sepot/providers/storage_provider.dart';
 
 class BiometricsTile extends ConsumerStatefulWidget {
@@ -48,6 +49,14 @@ class _BiometricsTileState extends ConsumerState<BiometricsTile> {
           _snack(l10n.biometricsStorageLocked);
           return;
         }
+        // Biometrie dostane kopii DEK — zapnout ji smí jen ten, kdo zná PIN.
+        // Otisk sám nestačí: v telefonu může být zapsaný i cizí prst.
+        if (!mounted ||
+            !await confirmSensitiveAction(context, ref,
+                reason: l10n.reauthReasonBiometrics,
+                allowBiometrics: false)) {
+          return;
+        }
         final auth = LocalAuthentication();
         if (!await auth.isDeviceSupported()) {
           _snack(l10n.biometricsNotAvailable);