fix(android): the save actually reuses the derived key

The log named it exactly: "Cle ou sel absent pour le rechiffrement". The edit
that swapped DecryptContainer for DecryptContainerEx had never been applied -
the timing line from the same change was missing too, which is what should have
told me. So the key was never collected and re-encryption refused.

Worth keeping in mind: the guard in EncryptContainerWithKey did its job. It
refused rather than encrypting under an empty key and writing a container
nobody could read into the vault. A failed save is an inconvenience; a
published unreadable snapshot would have been the kind of loss this whole
section is built to avoid.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mainApk.pas

@@ -610,8 +610,15 @@ begin
           end;
 
           try
-            LPlain := DecryptContainer(LGet.Container, FSyncPwd);
+            // UNE SEULE DERIVATION PAR ENREGISTREMENT : la variante Ex rend la
+            // cle, son sel et les iterations, que le rechiffrement reutilise.
+            // Deriver deux fois le meme mot de passe coutait une seconde fois
+            // quatre a six secondes, pour une cle equivalente.
+            LSw := TStopwatch.StartNew;
+            LPlain := DecryptContainerEx(LGet.Container, FSyncPwd,
+                        LKey, LSalt, LIter);
             LNew := PatchEntryField(LPlain, LUuid, 'password', ANewValue);
+            Log(Format('save: decrypt+patch in %d ms', [LSw.ElapsedMilliseconds]));
           except
             on E: Exception do
             begin