fix: security-audit remediation (15 findings), empty-wallet warning, and send/chat/console/shutdown UX

Security audit remediation (15 confirmed findings from the codebase audit):
- H-02: scrub+delete the decrypt-flow plaintext key export on ALL exit paths
  (RAII guard) and purge stale obsidiandecryptexport* files at startup.
- M-01/L-03/L-04/L-05/L-07: sodium_memzero the Set-PIN and encrypt-PIN worker
  passphrase/PIN copies, the RPC Basic-auth string (auth_), the exported/imported
  key buffers (App::wipeSecrets, called from ~App and before main's _Exit), and
  the first-run wizard "Skip" buffers.
- M-03/M-04/M-05/L-06: return locked COPIES from XmrigManager/EmbeddedDaemon
  getters (dedicated error_mutex_; DaemonController::lastError now by value),
  route xmrig last_error_ writes through a locked setter, and wrap
  shutdown_status_/wizard_stop_status_ in a locking GuardedStatus
  (wizard_stopping_external_ -> std::atomic).
- M-02: persist after a console send/shield/import in the lite backend.
- L-01: require the confirm click for z_shieldcoinbase/z_mergetoaddress.
- L-02: quote/escape each Windows daemon argv per the MSDN CommandLineToArgvW rules.
- L-08: pin json/tomlplusplus/libwebp FetchContent to immutable commit SHAs.
- I-01: extract updater archives from the already-verified in-memory buffer
  (no disk re-read TOCTOU).

Feature: warn once (full-node) when the active wallet loads empty while a sibling
wallet file in the datadir holds keys. A funded salvage wallet.<ts>.bak routes to
the recovery/Restore flow; a funded sibling .dat routes to the wallet manager.
Per-wallet-file dismissal; gated on synced + address-list-loaded to avoid false
positives on warm reconnect / spent-down wallets.

UX fixes:
- send: show the TOTAL balance (with a spendable "available" note) in the source
  dropdown and keep pending-change addresses visible.
- chat: insert emoji at the cursor position; restrict new-chat recipients to
  shielded (z) addresses.
- console: optional auto-focus of the command input on tab open (off by default).
- shutdown: when "stop external daemon" is on, keep the shutdown screen up until
  the external node actually exits, showing live status.

Adversarially reviewed; verified across full-node, lite, and Windows builds; tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/rpc/rpc_client.cpp

@@ -146,7 +146,11 @@ RPCClient::RPCClient() : impl_(std::make_unique<Impl>())
 {
 }
 
-RPCClient::~RPCClient() = default;
+RPCClient::~RPCClient() {
+    // Scrub the persistent Basic-auth secret on destruction (disconnect() may not have run). impl_ is
+    // still destroyed normally afterward (curl cleanup unchanged). (L-04)
+    if (!auth_.empty()) sodium_memzero(auth_.data(), auth_.size());
+}
 
 bool RPCClient::connect(const std::string& host, const std::string& port,
                         const std::string& user, const std::string& password)
@@ -166,6 +170,7 @@ bool RPCClient::connect(const std::string& host, const std::string& port,
     // Create Basic auth header with proper base64 encoding, then wipe the plaintext
     // "user:password" temporary (std::string does not zero its buffer on destruction).
     std::string credentials = user + ":" + password;
+    if (!auth_.empty()) sodium_memzero(auth_.data(), auth_.size());   // wipe any prior secret before overwrite (L-04)
     auth_ = util::base64_encode(credentials);
     if (!credentials.empty()) sodium_memzero(credentials.data(), credentials.size());
 
@@ -193,6 +198,7 @@ bool RPCClient::connect(const std::string& host, const std::string& port,
     impl_->headers = curl_slist_append(nullptr, "Content-Type: text/plain");
     std::string auth_header = "Authorization: Basic " + auth_;
     impl_->headers = curl_slist_append(impl_->headers, auth_header.c_str());
+    if (!auth_header.empty()) sodium_memzero(auth_header.data(), auth_header.size());   // curl copied it (L-04)
 
     // Configure curl
     curl_easy_setopt(impl_->curl, CURLOPT_URL, impl_->url.c_str());
@@ -299,6 +305,7 @@ void RPCClient::disconnect()
         curl_slist_free_all(impl_->headers);
         impl_->headers = nullptr;
     }
+    if (!auth_.empty()) { sodium_memzero(auth_.data(), auth_.size()); auth_.clear(); }   // scrub Basic-auth secret (L-04)
 }
 
 json RPCClient::makePayload(const std::string& method, const json& params)