fix(sweep): keep the UI sweep away from real wallet data

The full UI sweep (dev builds only) ran its demo surfaces against the
real profile. Its teardown deleted wallet-{cold,trading,mining,donations,
2023,payroll}.dat from the real datadir, it created zero-filled wallet
files and picker-demo/extra-wallets folders, its demo wallet-index upsert
re-minted the active wallet's scopeId (hiding "w:"-scoped contacts), the
Contacts tab could re-attach legacy-scoped contacts to such a throwaway
id in addressbook.json, and it persisted the demo active wallet file and
Mining pool worker.

- Preflight: a full sweep is refused (toast + log line) while a real
  workflow is in flight: a pending seed_migration_* setting or open
  migrate dialog, a wallet switch, an encryption/import workflow, an
  encrypt/PIN/lock operation, the seed-backup dialog, or a bootstrap.
  The DRAGONX_FULL_SWEEP hook then exits as for an empty catalog.
- Persistence latches: AddressBook (snapshot on the first sweepBegin,
  save/load latched while a demo-contacts surface is shown), WalletIndex
  and Settings (active wallet file, contacts view mode, pool URL/worker)
  for the whole sweep. Settings::sweepEnd() is the last statement of
  clearDemoWalletData and flushes once only if a save was suppressed; a
  quit mid-sweep writes nothing to the profile (the 0700 sandbox, with
  zero-filled demo files only, may stay in the temp dir).
- Scope ids: during a full sweep activeWalletScopeId() returns the
  persisted id or "" and never mints one, so the Contacts tab cannot
  move legacy-scoped contacts to a throwaway id. The only address-book
  write a sweep can still cause is the one-time legacy re-attach to the
  wallet's persisted id, which opening Contacts does anyway.
- Sandbox: demo wallet files and folders go to a fresh random 0700 dir
  under the temp dir (exclusive create, a pre-existing path or symlink
  is refused), removed at sweep end. The teardown that deleted those six
  wallet files is gone.
- Cleanup: the migrate-to-seed state, wizard phase, demo chat
  conversations and a fabricated demo chat identity are reset at sweep
  end; the seed-backup surface always shows the demo phrase and a real
  z_exportmnemonic result is dropped while the sweep runs.
- i18n: one new key (screenshot_sweep_refused) in i18n.cpp and the 8
  language files.

Tests: the address book snapshots only on the first sweepBegin, keeps
addressbook.json byte-identical while latched and restores the real
book; the wallet index keeps wallets.json and the real scope id, also
with the background writer attached; Settings restores the latched
values and flushes once only when a save was suppressed; the sandbox
helper refuses a pre-existing path or symlink and removes only a
prefixed dir, never a symlink's target.

Release note: v2.0.x UI sweeps could delete wallet-{cold,trading,mining,
donations,2023,payroll}.dat from the data directory and re-scope
contacts; this cannot be undone automatically.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app.h

@@ -293,8 +293,9 @@ public:
                                   const std::string& text);
     // Debug/sweep convenience: give the Chat tab a demo identity + a few sample conversations
     // (in-memory only, not persisted) so the screenshot sweep captures the populated UI. No-op when
-    // the chat feature is off.
-    void seedChatDemoData();
+    // the chat feature is off. Returns true when it had to fabricate the (random) demo identity
+    // because none was provisioned, so the sweep can drop it again at the end.
+    bool seedChatDemoData();
     // Reason the lite wallet failed to auto-open this session (empty if none / opened OK).
     const std::string& liteOpenError() const { return lite_open_error_; }
     // Show the lite send-time unlock modal (called when a spend is attempted on a locked wallet).
@@ -320,7 +321,8 @@ public:
     // Stable per-wallet id ("w:"+hex) for scoping persistent per-wallet data (address-book contacts).
     // Generated once and persisted in the wallet index (keyed by wallet file), never recomputed from
     // the mutable address set — so creating addresses / locking / disconnecting never changes it.
-    // Empty only when there is no active wallet file. Establishes + persists the id on first call.
+    // Empty only when there is no active wallet file. Establishes + persists the id on first call,
+    // except during a full UI sweep (capture_mode_), where it returns the existing id or "".
     std::string activeWalletScopeId();
 
     data::WalletIndex& walletIndex() { return wallet_index_; }
@@ -1593,9 +1595,14 @@ private:
     // RPC, no auto-lock, no async pump. New async paths that could run mid-sweep must guard on it.
     bool capture_mode_ = false;
     void startSweepImpl(bool full);
+    // Why a full sweep must not start now (a real wallet workflow is in flight), or nullptr.
+    const char* fullSweepBlockedReason() const;
     void buildSweepCatalog();
     void installDemoWalletData();
     void clearDemoWalletData();
+    // The full sweep's private temp dir (demo wallet files and folders); "" when none.
+    std::string sweep_sandbox_;
+    bool sweep_chat_identity_fabricated_ = false;   // seedChatDemoData() made the demo chat identity
     void applyHealthyDemoState();  // reset the connection/encryption flags to the healthy demo values
     void writeSweepManifest() const;
     // Snapshot of the state_ fields the demo installer mutates, restored at sweep end. Kept as a
@@ -1611,6 +1618,7 @@ private:
         std::vector<TransactionInfo> transactions;
         double market_price_usd=0;
         double market_change_24h=0;
+        WizardPhase wizard_phase = WizardPhase::None;   // the demo state dismisses the wizard
     } sweep_state_snapshot_;
     bool  sidebar_user_toggled_ = false; // user manually toggled — suppress auto-collapse
     float sidebar_width_anim_ = 0.0f;  // animated width (0 = uninitialized)