fix(security): reconcile the encryption-pending flag on every connect

The wizard persists an "encryption requested" flag so a quit or crash
before the wallet is actually encrypted is not silent. That flag was
only reconciled on the slow-path getwalletinfo refresh, so it could be
left stale, and the clear-and-warn logic lived inline in two places.

- A single reconcileEncryptionPending now runs on every connect and on
  every encryption-state refresh, keyed on the parsed getwalletinfo
  reply. It clears the flag whenever the wallet is encrypted, however it
  got there (deferred request, Settings, another client), and warns once
  per session when encryption was requested but the wallet is not
  encrypted and nothing is pending or in flight.
- A failed or warm-up (-28) RPC decides nothing, so a 15 s timeout that
  forces encrypted=false can no longer mis-clear or mis-warn.
- The flag is also cleared at encryptwallet success and when the user
  removes encryption, so neither path leaves a stale flag that would
  warn on the next connect. No settings format change.

Tests: the pure decision helper over the flag, RPC-ok, encrypted,
deferred-pending, in-flight and already-warned combinations (clear when
encrypted, warn once when lost, nothing on a failed RPC or no flag).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/data/wallet_security_reconcile.h

@@ -0,0 +1,23 @@
+#pragma once
+#include <cstdint>
+
+namespace dragonx {
+namespace data {
+
+enum class EncryptionPendingAction { None, Clear, Warn };
+
+// What to do with the persisted "encryption requested in the wizard" flag, given ONE parsed getwalletinfo
+// result. rpcOk must come from the parsed reply (a -28 warm-up failure or a throw is rpcOk=false => None);
+// never derive it from WalletState (a 15 s timeout forces encrypted=false there).
+inline EncryptionPendingAction decideEncryptionPending(bool flagSet, bool rpcOk, bool walletEncrypted,
+                                                       bool deferredPending, bool encryptInProgress,
+                                                       bool alreadyWarned)
+{
+    if (!flagSet || !rpcOk) return EncryptionPendingAction::None;
+    if (walletEncrypted) return EncryptionPendingAction::Clear;
+    if (deferredPending || encryptInProgress || alreadyWarned) return EncryptionPendingAction::None;
+    return EncryptionPendingAction::Warn;
+}
+
+}  // namespace data
+}  // namespace dragonx