fix(android): locking the vault no longer discards the typed settings

Reported as "the token field saves nothing", and it was exact: LockVault
called PushConfig, which pushes the STORED server settings back into the page.
Every lock therefore overwrote a freshly typed token with the old one -
including the three-minute auto-lock, so it happened with no gesture from the
user at all, and the field looked like it forgot on its own.

The user's own sequence isolated it: deleting one character gave a 401, which
proves the typed value does reach the wire; then open, lock, sync gave a 200
again, the lock having restored the old token in between.

PushConfig now runs at startup only. It was pointless in the other four places
anyway: PM.wipe clears the list and the detail, never the configuration fields.

Along the way, and part of the same confusion: the three settings fields had no
labels, only placeholders that vanish once filled - and since the token was
masked this morning it became indistinguishable from the sync password sitting
right below it. They are labelled now, and the log reports both fingerprints so
a value landing in the neighbouring field shows up immediately.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

android-client/web/app.html

@@ -186,6 +186,8 @@
     font: inherit; outline: none;
   }
   .field-in::placeholder { color: var(--muted); }
+  .in-label { color: var(--muted); font-size: 12px; margin: 10px 0 -2px 4px; }
+  .in-label span { opacity: .7; }
   #log {
     margin: 10px 0 0; padding: 10px 12px; max-height: 34vh; overflow: auto;
     background: rgba(0,0,0,.20); border-radius: var(--radius-s);
@@ -219,7 +221,13 @@
            depot, jamais dans le coffre. -->
       <button class="btn wide" id="btnWriteTest" hidden>Write test (debug)</button>
     </div>
+    <!-- DES LIBELLES, PAS SEULEMENT DES INDICATIONS D'AIDE. Celles-ci
+         disparaissent des que le champ est rempli, et depuis que le jeton est
+         masque comme le mot de passe, deux champs en points noirs se
+         succedent sans rien qui les distingue - on colle alors dans le mauvais
+         sans que rien ne le signale. -->
     <div id="cfg" hidden>
+      <div class="in-label">Endpoint URL</div>
       <input class="field-in" id="url" placeholder="endpoint URL"
              autocomplete="off" autocorrect="off" autocapitalize="none"
              spellcheck="false" inputmode="url">
@@ -227,8 +235,10 @@
            clair alors qu'il ouvre le depot : le moins grave des trois secrets
            de cet ecran, mais le seul qu'un regard par-dessus l'epaule
            attrapait. On le saisit une fois ; le relire n'a aucun usage. -->
+      <div class="in-label">Gitea token <span>&#183; needs read AND write</span></div>
       <input class="field-in" id="tok" placeholder="bearer token"
              type="password" autocomplete="off">
+      <div class="in-label">Sync password <span>&#183; decrypts the vault</span></div>
       <input class="field-in" id="pwd" placeholder="sync password"
              type="password" autocomplete="off">
     </div>