fix: security-audit remediation (15 findings), empty-wallet warning, and send/chat/console/shutdown UX

Security audit remediation (15 confirmed findings from the codebase audit):
- H-02: scrub+delete the decrypt-flow plaintext key export on ALL exit paths
  (RAII guard) and purge stale obsidiandecryptexport* files at startup.
- M-01/L-03/L-04/L-05/L-07: sodium_memzero the Set-PIN and encrypt-PIN worker
  passphrase/PIN copies, the RPC Basic-auth string (auth_), the exported/imported
  key buffers (App::wipeSecrets, called from ~App and before main's _Exit), and
  the first-run wizard "Skip" buffers.
- M-03/M-04/M-05/L-06: return locked COPIES from XmrigManager/EmbeddedDaemon
  getters (dedicated error_mutex_; DaemonController::lastError now by value),
  route xmrig last_error_ writes through a locked setter, and wrap
  shutdown_status_/wizard_stop_status_ in a locking GuardedStatus
  (wizard_stopping_external_ -> std::atomic).
- M-02: persist after a console send/shield/import in the lite backend.
- L-01: require the confirm click for z_shieldcoinbase/z_mergetoaddress.
- L-02: quote/escape each Windows daemon argv per the MSDN CommandLineToArgvW rules.
- L-08: pin json/tomlplusplus/libwebp FetchContent to immutable commit SHAs.
- I-01: extract updater archives from the already-verified in-memory buffer
  (no disk re-read TOCTOU).

Feature: warn once (full-node) when the active wallet loads empty while a sibling
wallet file in the datadir holds keys. A funded salvage wallet.<ts>.bak routes to
the recovery/Restore flow; a funded sibling .dat routes to the wallet manager.
Per-wallet-file dismissal; gated on synced + address-list-loaded to avoid false
positives on warm reconnect / spent-down wallets.

UX fixes:
- send: show the TOTAL balance (with a spendable "available" note) in the source
  dropdown and keep pending-change addresses visible.
- chat: insert emoji at the cursor position; restrict new-chat recipients to
  shielded (z) addresses.
- console: optional auto-focus of the command input on tab open (off by default).
- shutdown: when "stop external daemon" is on, keep the shutdown screen up until
  the external node actually exits, showing live status.

Adversarially reviewed; verified across full-node, lite, and Windows builds; tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/config/settings.cpp

@@ -204,6 +204,7 @@ bool Settings::load(const std::string& path)
         loadScalar(j, "console_text_color", console_text_color_);
         loadScalar(j, "console_zoom", console_zoom_);
         if (!(console_zoom_ >= 0.25f && console_zoom_ <= 4.0f)) console_zoom_ = 1.0f;  // guard bad/NaN
+        loadScalar(j, "console_auto_focus", console_auto_focus_);
         if (j.contains("hidden_addresses") && j["hidden_addresses"].is_array()) {
             hidden_addresses_.clear();
             for (const auto& a : j["hidden_addresses"])
@@ -231,6 +232,11 @@ bool Settings::load(const std::string& path)
         }
         loadScalar(j, "wizard_completed", wizard_completed_);
         loadScalar(j, "seed_backup_reminded", seed_backup_reminded_);
+        if (j.contains("empty_wallet_warning_acked") && j["empty_wallet_warning_acked"].is_array()) {
+            empty_wallet_warning_acked_.clear();
+            for (const auto& w : j["empty_wallet_warning_acked"])
+                if (w.is_string()) empty_wallet_warning_acked_.insert(w.get<std::string>());
+        }
         loadScalar(j, "encryption_pending", encryption_pending_);
         loadScalar(j, "daemon_update_prompted_size", daemon_update_prompted_size_);
         loadScalar(j, "active_wallet_file", active_wallet_file_);
@@ -478,6 +484,7 @@ bool Settings::save(const std::string& path)
     j["console_line_accents"] = console_line_accents_;
     j["console_text_color"] = console_text_color_;
     j["console_zoom"] = console_zoom_;
+    j["console_auto_focus"] = console_auto_focus_;
     j["hidden_addresses"] = json::array();
     for (const auto& addr : hidden_addresses_)
         j["hidden_addresses"].push_back(addr);
@@ -499,6 +506,9 @@ bool Settings::save(const std::string& path)
     }
     j["wizard_completed"] = wizard_completed_;
     j["seed_backup_reminded"] = seed_backup_reminded_;
+    j["empty_wallet_warning_acked"] = json::array();
+    for (const auto& w : empty_wallet_warning_acked_)
+        j["empty_wallet_warning_acked"].push_back(w);
     j["encryption_pending"] = encryption_pending_;
     j["daemon_update_prompted_size"] = daemon_update_prompted_size_;
     j["active_wallet_file"] = active_wallet_file_;

src/config/settings.h

@@ -256,6 +256,9 @@ public:
     void setConsoleTextColor(bool v) { console_text_color_ = v; }
     float getConsoleZoom() const { return console_zoom_; }
     void setConsoleZoom(float v) { console_zoom_ = v; }
+    // Auto-place the text cursor in the command box when the Console tab is opened.
+    bool getConsoleAutoFocus() const { return console_auto_focus_; }
+    void setConsoleAutoFocus(bool v) { console_auto_focus_ = v; }
 
     // Hidden addresses (addresses hidden from the UI by the user)
     const std::set<std::string>& getHiddenAddresses() const { return hidden_addresses_; }
@@ -327,6 +330,14 @@ public:
     bool getSeedBackupReminded() const { return seed_backup_reminded_; }
     void setSeedBackupReminded(bool v) { seed_backup_reminded_ = v; }
 
+    // Wallet filenames for which the one-time "this wallet is empty but a sibling holds funds"
+    // warning has been dismissed. Keyed per active wallet file so switching to a different empty
+    // wallet can warn again (see App::maybeWarnEmptyWalletWithFundedSiblings).
+    bool isEmptyWalletWarnAcked(const std::string& walletFile) const {
+        return empty_wallet_warning_acked_.count(walletFile) > 0;
+    }
+    void ackEmptyWalletWarn(const std::string& walletFile) { empty_wallet_warning_acked_.insert(walletFile); }
+
     // Persisted the moment deferred (wizard) encryption is requested; cleared only once the wallet is
     // observed to be actually encrypted. Lets a quit/crash/failed-connect before it applies be detected
     // and surfaced (W2-2). NEVER stores the passphrase — only the fact that encryption was requested.
@@ -580,11 +591,13 @@ private:
     bool console_line_accents_ = true;   // left color accent bars in console output
     bool console_text_color_ = true;     // per-channel text coloring in console output
     float console_zoom_ = 1.0f;          // console output font zoom factor
+    bool console_auto_focus_ = false;    // focus the command input when the Console tab is opened (opt-in)
     std::set<std::string> hidden_addresses_;
     std::set<std::string> favorite_addresses_;
     std::map<std::string, AddressMeta> address_meta_;
     bool wizard_completed_ = false;
     bool seed_backup_reminded_ = false;
+    std::set<std::string> empty_wallet_warning_acked_;  // wallet files whose empty-wallet warning was dismissed
     bool encryption_pending_ = false;
     long long daemon_update_prompted_size_ = 0;  // bundled daemon size last offered via the update prompt
     std::string active_wallet_file_ = "wallet.dat";  // -wallet=<name> the daemon loads (multi-wallet)