fix(android): the unlock code re-seals the cache when the vault opens

Setting a code and syncing did nothing, and the log said why: "304: unchanged,
vault served from cache". A sync only writes when the remote actually changed,
and it is the write that re-seals - so vault.bin kept its old format and its
old date, and the code looked inert. My instruction to type the code and sync
was wrong; I gave it without following the path.

Re-sealing belongs where the plaintext is already in hand: opening the vault.
That spot has a precedent - the existing path that re-seals under
authentication when a screen lock reappears - and the code now takes priority
over it, since the two protections do not stack.

The log also names the format it opened, so "sealed under the unlock code" can
be read rather than inferred from the absence of a warning.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mainApk.pas

@@ -1009,11 +1009,29 @@ begin
     // Journalise le verdict MEME quand rien n'est fait : sans cette ligne, un
     // rescellement qui n'a pas lieu ne laisse aucune trace, et on ne sait pas
     // s'il a echoue ou s'il n'a jamais ete tente.
-    if not VaultNeedsAuth then
+    if VaultNeedsPin then
+      Log('Cache sealed under the unlock code')
+    else if not VaultNeedsAuth then
       Log('Plain cache; device authentication available: ' +
           BoolToStr(BiometricAvailable, True) + ' ' + LastBiometricError);
 
-    if (not VaultNeedsAuth) and BiometricAvailable then
+    // LE CODE RESCELLE ICI, ET NULLE PART AILLEURS. Poser un code puis
+    // synchroniser ne suffisait pas : une synchronisation qui repond 304
+    // n'ecrit rien, donc le cache restait dans son ancienne forme et le code
+    // semblait sans effet. L'ouverture, elle, tient le clair a chaque fois.
+    if (FPin <> '') and (not VaultNeedsPin) then
+    begin
+      try
+        SaveVault(LPlain, LETag, LPwd, False, False, FPin);
+        if VaultNeedsPin then
+          Log('Cache re-sealed under the unlock code')
+        else
+          Log('Re-seal under code refused: ' + LastStoreError);
+      except
+        on E: Exception do Log('Re-seal under code failed: ' + E.Message);
+      end;
+    end
+    else if (not VaultNeedsAuth) and (not VaultNeedsPin) and BiometricAvailable then
     begin
       try
         // Cle NEUVE, obligatoirement : le changement qui vient de ramener la