fix(android): the unlock code is asked for, and never undone in silence

Two defects, one feature made useless. The cache did seal under the code,
but nothing on the home screen asked for it: opening without one failed,
the failure was read as corruption, and the device offered to download a
vault it held perfectly well. And the next refresh rewrote the cache in
the old shape, so the code was undone seconds after being set, silently.

The code now lives on the home screen, not among the server settings: it
seals this device's cache, while the other three fields describe the
shared remote. Always visible - hiding it when none is set would remove
the only place to set one - the hint saying which case you are in. An
absent code is no longer attempted, a wrong one is no longer corruption,
and a sealed cache is never rewritten without its code.

The two panels each got an arrow, and only one opens at a time.

Measured end to end on the device: version byte 1, code typed, open, byte
4; cold start says "Unlock code required" and open without the code
leaves the byte at 4; correct code opens the vault, and the refresh that
follows leaves it at 4.

android-client/PMA.Store.pas

@@ -797,6 +797,22 @@ begin
   // ETag, mot de passe et coffre chiffres ENSEMBLE : ils doivent rester
   // coherents. Un ETag qui survivrait a un coffre illisible ferait repondre
   // 304 au serveur alors que l'application n'a rien a afficher.
+  // UN CACHE SCELLE SOUS UN CODE NE SE REECRIT JAMAIS SANS LUI. Sans cette
+  // regle, le premier rafraichissement venu le reecrivait dans l'ancienne
+  // forme - le code etait pose, puis defait en silence quelques secondes plus
+  // tard, sans que rien ne le dise. Le refuser fait perdre un instantane, ce
+  // que la prochaine ouverture rattrape ; l'accepter fait perdre la
+  // protection, ce que rien ne rattrape.
+  //
+  // Retirer le code demanderait donc un geste explicite, qui n'existe pas
+  // encore : aujourd'hui on le remplace en le retapant.
+  if (APin = '') and VaultNeedsPin then
+  begin
+    FLastStoreError := 'cache sealed under an unlock code; refusing to ' +
+                       'rewrite it without one';
+    Exit;
+  end;
+
   LWrap := TJSONObject.Create;
   try
     LWrap.AddPair('etag', AETag);