feat(android): a settings screen, and the unlock code can finally be removed

Three things of different natures lived in collapsible panels on the home
screen - repository credentials, the unlock code, the log - on the one screen
where one mostly wants to open one's vault. They move to a settings sheet,
reachable from the list too.

A sheet, not a fourth view of the rail: each view costs its transform rules
and a place in back-key navigation, and settings is not somewhere one moves
about - it is a parenthesis one opens and closes.

The unlock code can now be REMOVED. It could not before: clearing the field
meant "nothing typed", not "drop the protection", so one could set a code and
never get out. It requires an open vault, and that is the proof being asked
for - the cache only let itself be read under the right code. Without that,
anyone holding the unlocked phone could lift the protection without knowing
it.

The refusal that guards every other path stays: it is what stopped a sync
from silently undoing a code. Removing is the one deliberate way out, and it
says so at the call site.

The old fields stay in the document as the source Delphi knows; the sheet is
only a view of them. Emptying them would lose the configuration at the first
sync.

android-client/PMA.Store.pas

@@ -98,7 +98,8 @@ function HasVault: Boolean;
 procedure SaveVault(const APlainJson, AETag, ASyncPwd: string;
   ARequireAuth: Boolean = False; AFreshKey: Boolean = False;
   const APin: string = ''; const AKey: TBytes = nil;
-  const ASalt: TBytes = nil; AIterations: Integer = 0);
+  const ASalt: TBytes = nil; AIterations: Integer = 0;
+  AClearPin: Boolean = False);
 
 /// Le fichier local est-il scelle sous un code d'application ? Lu dans
 /// l'en-tete, sans rien dechiffrer.
@@ -887,7 +888,7 @@ end;
 
 procedure SaveVault(const APlainJson, AETag, ASyncPwd: string;
   ARequireAuth, AFreshKey: Boolean; const APin: string;
-  const AKey, ASalt: TBytes; AIterations: Integer);
+  const AKey, ASalt: TBytes; AIterations: Integer; AClearPin: Boolean);
 {$IF DEFINED(ANDROID)}
 var
   LWrap: TJSONObject;
@@ -908,7 +909,12 @@ begin
   //
   // Retirer le code demanderait donc un geste explicite, qui n'existe pas
   // encore : aujourd'hui on le remplace en le retapant.
-  if (APin = '') and VaultNeedsPin then
+  // AClearPin EST LA SEULE SORTIE, et elle se demande. Le refus ci-dessous
+  // protege tous les autres chemins - c'est lui qui a empeche une
+  // synchronisation de defaire un code en silence. Retirer un code reste
+  // possible, mais seulement quand quelqu'un l'a decide et vient de prouver
+  // qu'il le connaissait en ouvrant le coffre.
+  if (APin = '') and VaultNeedsPin and not AClearPin then
   begin
     FLastStoreError := 'cache sealed under an unlock code; refusing to ' +
                        'rewrite it without one';