fix(prefs): stop pulling secret prefs into the renderer just to render the UI

A renderer dump taken after a quick-unlock, with nothing opened, contained the auto-backup password in cleartext - inside an ExecuteJavaScript string and in the DevTools protocol buffers - and it survived the auto-lock that wipes the vault key.

New prefs/has answers set-or-not without moving the value. The settings panel uses that; only the paths that encrypt a backup, test the WebDAV connection or run a sync fetch the secrets themselves.

js/app.backup.js

@@ -24,15 +24,21 @@ const ABK = {
 };
 const AUTO_BACKUP_PREFIX = 'vault-autobackup-';
 
-async function loadAutoBackupConfig() {
+// withPwd defaults to FALSE on purpose: the UI only ever needs to know whether
+// a backup password exists. Pulling the value across the bridge leaves it in
+// the renderer for the life of the process — verified in a memory dump, where
+// it was still there after the vault had auto-locked and the vault key was
+// gone. Only the two paths that actually encrypt a backup ask for it.
+async function loadAutoBackupConfig(withPwd) {
     if (!Bridge.active) return null;
-    const [enabled, dir, interval, keep, last, pwd] = await Promise.all([
+    const [enabled, dir, interval, keep, last, pwd, hasPwd] = await Promise.all([
         Bridge.getPref(ABK.enabled),
         Bridge.getPref(ABK.dir),
         Bridge.getPref(ABK.interval),
         Bridge.getPref(ABK.keep),
         Bridge.getPref(ABK.last),
-        Bridge.getPref(ABK.pwd),
+        withPwd ? Bridge.getPref(ABK.pwd) : Promise.resolve(''),
+        Bridge.hasPref(ABK.pwd),
     ]);
     return {
         enabled:  enabled === '1',
@@ -40,7 +46,7 @@ async function loadAutoBackupConfig() {
         interval: Math.max(1, parseInt(interval, 10) || 7),
         keep:     Math.max(1, parseInt(keep,     10) || 10),
         last:     last || '',
-        hasPwd:   !!pwd,
+        hasPwd:   !!hasPwd,
         pwd,
     };
 }
@@ -139,7 +145,8 @@ async function changeBackupPwd() {
 }
 
 async function runAutoBackupNow(silent) {
-    const cfg = await loadAutoBackupConfig();
+    // withPwd: this is the one place that encrypts a backup.
+    const cfg = await loadAutoBackupConfig(true);
     if (!cfg) return silent || toast('Bridge not available', 'error');
     if (!cfg.dir) return silent || toast('Choose a backup folder first', 'warning');
     if (!cfg.hasPwd) return silent || toast('Backup password not set', 'warning');
@@ -263,6 +270,8 @@ async function applyAutoBackupRetention(dir, keep) {
 
 async function runAutoBackupIfDue() {
     if (!Bridge.active) return;
+    // No password yet: the due-check reads only metadata. runAutoBackupNow
+    // fetches the secret itself, and only if a run is actually starting.
     const cfg = await loadAutoBackupConfig();
     if (!cfg || !cfg.enabled || !cfg.dir || !cfg.hasPwd) return;
     if (!state.cryptoKey) return;