fix(prefs): stop pulling secret prefs into the renderer just to render the UI

A renderer dump taken after a quick-unlock, with nothing opened, contained the auto-backup password in cleartext - inside an ExecuteJavaScript string and in the DevTools protocol buffers - and it survived the auto-lock that wipes the vault key.

New prefs/has answers set-or-not without moving the value. The settings panel uses that; only the paths that encrypt a backup, test the WebDAV connection or run a sync fetch the secrets themselves.

delphi-backend/UMainForm.pas

@@ -1280,6 +1280,25 @@ begin
       'Bridge.onPrefResult("' + LEscapedKey + '","' + LEscapedVal + '")');
   end
 
+  // Existence probe. Some prefs ARE secrets (the auto-backup password, the sync
+  // passwords) and the UI mostly only needs to know whether one is set. Asking
+  // through prefs/get would interpolate the secret into an ExecuteJavaScript
+  // string — measured in a renderer dump, where it also showed up in the
+  // DevTools protocol buffers, and it stayed there after the vault auto-locked.
+  // The answer rides the same callback under "<key>#has".
+  else if ACmd = 'prefs/has' then
+  begin
+    var LHasKey := GetParam('key');
+    if LHasKey = '' then Exit;
+    var LEsc := StringReplace(LHasKey, '\', '\\', [rfReplaceAll]);
+    LEsc := StringReplace(LEsc, '"', '\"', [rfReplaceAll]);
+    var LSet := '';
+    if PM.UserPrefs.GetPref(LHasKey) <> '' then LSet := '1';
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onPrefResult)' +
+      'Bridge.onPrefResult("' + LEsc + '#has","' + LSet + '")');
+  end
+
   else if ACmd = 'prefs/set' then
   begin
     var LKey := GetParam('key');