fix(android): encryption cannot see a dead key, so stop pretending it can

The retry I added yesterday never fired, and could not: the public key is
rebuilt through KeyFactory, so it is an ordinary RSA key with no link to the
Keystore. It encrypts perfectly well while its private half is permanently
invalidated. The re-seal therefore sealed the cache with a key nothing would
ever open again - the app asked for the sync password instead of the pattern.

Invalidation is observable at exactly one moment: reading with the private
key. LoadVault now drops the alias when the system names the cause, so the
next write mints a fresh pair instead of sealing another unopenable file.

And the caller that re-seals a plain cache asks for a fresh key outright:
protection reappearing on the device is precisely the event that invalidated
the old one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mainApk.pas

@@ -119,7 +119,6 @@ type
     FLayDetail: TLayout;
     FDetBody: TVertScrollBox;
     FDetTitle, FDetToast: TLabel;
-    FBtnReveal: TRectangle;
     FRows: TArray<TDetRow>;
     FRowCtls: TArray<TLayout>;
     FRowValues: TArray<TLabel>;
@@ -843,7 +842,11 @@ begin
     if (not VaultNeedsAuth) and BiometricAvailable then
     begin
       try
-        SaveVault(LPlain, LETag, LPwd, True);
+        // Cle NEUVE, obligatoirement : le changement qui vient de ramener la
+        // protection a tres probablement invalide l'ancienne, et le
+        // chiffrement ne saurait pas le voir - on scellerait un fichier
+        // impossible a rouvrir.
+        SaveVault(LPlain, LETag, LPwd, True, True);
         if VaultNeedsAuth then
           Log('Cache re-sealed under authentication')
         else