fix(prefs): stop pulling secret prefs into the renderer just to render the UI

A renderer dump taken after a quick-unlock, with nothing opened, contained the auto-backup password in cleartext - inside an ExecuteJavaScript string and in the DevTools protocol buffers - and it survived the auto-lock that wipes the vault key.

New prefs/has answers set-or-not without moving the value. The settings panel uses that; only the paths that encrypt a backup, test the WebDAV connection or run a sync fetch the secrets themselves.

js/app.js

@@ -269,6 +269,25 @@ const Bridge = (() => {
                 }, 2000);
             });
         },
+        // "Is this pref set?" without pulling the value across. For the ones
+        // that are secrets (backup / sync passwords) the UI usually only needs
+        // the boolean, and fetching the value would leave it sitting in the
+        // renderer — and in the DevTools protocol buffers — until the process
+        // dies, surviving even an auto-lock.
+        hasPref(key) {
+            if (!active) return Promise.resolve(false);
+            return new Promise(resolve => {
+                const slot = key + '#has';
+                prefResolvers[slot] = v => resolve(v === '1');
+                cmd('cmd://prefs/has?key=' + encodeURIComponent(key));
+                setTimeout(() => {
+                    if (prefResolvers[slot]) {
+                        delete prefResolvers[slot];
+                        resolve(false);
+                    }
+                }, 2000);
+            });
+        },
         setPref(key, value) {
             if (!active) return;
             cmd('cmd://prefs/set?key=' + encodeURIComponent(key) +