fix(android): ask for the device credential alone when no biometric is enrolled

The re-seal never ran and left no trace, because a branch not taken logs nothing. It logs now, verdict and reason, whether or not anything happens - the absence of a line was itself the thing that cost time.

And the verdict may have been wrong: asking canAuthenticate for BIOMETRIC_STRONG together with DEVICE_CREDENTIAL can fail outright on a device with a pattern and no enrolled fingerprint, instead of keeping what exists. It now falls back to the credential alone, which is all the key needs, and AuthenticateThen presents whichever set answered - offering something else would draw the same refusal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mainApk.pas

@@ -839,6 +839,13 @@ begin
     // pendant que l'appareil n'avait pas de verrouillage restait en clair
     // indefiniment, meme apres en avoir remis un. On le rescelle ici, ou l'on
     // tient justement le clair.
+    // Journalise le verdict MEME quand rien n'est fait : sans cette ligne, un
+    // rescellement qui n'a pas lieu ne laisse aucune trace, et on ne sait pas
+    // s'il a echoue ou s'il n'a jamais ete tente.
+    if not VaultNeedsAuth then
+      Log('Plain cache; device authentication available: ' +
+          BoolToStr(BiometricAvailable, True) + ' ' + LastBiometricError);
+
     if (not VaultNeedsAuth) and BiometricAvailable then
     begin
       try