fix(android): the token is stored, not displayed

Kept in settings.bin, because the silent refresh needs it and so does the
first download on a fresh device - there is no vault to hide it in yet. But it
was the only secret on that screen shown in clear, right beside a masked
password field, and it is also the least protected of the three: settings.bin
is sealed by the no-auth Keystore key, readable without authentication, unlike
the vault.

Masked now. It is typed once, and reading it back has no use - a wrong token
shows up as a 401 in the log, not by squinting at the field.

What it opens stays worth knowing: read access to the account's repositories,
whose only content is ciphertext.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

android-client/web/app.html

@@ -219,9 +219,12 @@
       <input class="field-in" id="url" placeholder="endpoint URL"
              autocomplete="off" autocorrect="off" autocapitalize="none"
              spellcheck="false" inputmode="url">
+      <!-- MASQUE, comme le mot de passe juste en dessous. Il s'affichait en
+           clair alors qu'il ouvre le depot : le moins grave des trois secrets
+           de cet ecran, mais le seul qu'un regard par-dessus l'epaule
+           attrapait. On le saisit une fois ; le relire n'a aucun usage. -->
       <input class="field-in" id="tok" placeholder="bearer token"
-             autocomplete="off" autocorrect="off" autocapitalize="none"
+             type="password" autocomplete="off">
-             spellcheck="false">
       <input class="field-in" id="pwd" placeholder="sync password"
              type="password" autocomplete="off">
     </div>