fix: security-audit remediation (15 findings), empty-wallet warning, and send/chat/console/shutdown UX

Security audit remediation (15 confirmed findings from the codebase audit):
- H-02: scrub+delete the decrypt-flow plaintext key export on ALL exit paths
  (RAII guard) and purge stale obsidiandecryptexport* files at startup.
- M-01/L-03/L-04/L-05/L-07: sodium_memzero the Set-PIN and encrypt-PIN worker
  passphrase/PIN copies, the RPC Basic-auth string (auth_), the exported/imported
  key buffers (App::wipeSecrets, called from ~App and before main's _Exit), and
  the first-run wizard "Skip" buffers.
- M-03/M-04/M-05/L-06: return locked COPIES from XmrigManager/EmbeddedDaemon
  getters (dedicated error_mutex_; DaemonController::lastError now by value),
  route xmrig last_error_ writes through a locked setter, and wrap
  shutdown_status_/wizard_stop_status_ in a locking GuardedStatus
  (wizard_stopping_external_ -> std::atomic).
- M-02: persist after a console send/shield/import in the lite backend.
- L-01: require the confirm click for z_shieldcoinbase/z_mergetoaddress.
- L-02: quote/escape each Windows daemon argv per the MSDN CommandLineToArgvW rules.
- L-08: pin json/tomlplusplus/libwebp FetchContent to immutable commit SHAs.
- I-01: extract updater archives from the already-verified in-memory buffer
  (no disk re-read TOCTOU).

Feature: warn once (full-node) when the active wallet loads empty while a sibling
wallet file in the datadir holds keys. A funded salvage wallet.<ts>.bak routes to
the recovery/Restore flow; a funded sibling .dat routes to the wallet manager.
Per-wallet-file dismissal; gated on synced + address-list-loaded to avoid false
positives on warm reconnect / spent-down wallets.

UX fixes:
- send: show the TOTAL balance (with a spendable "available" note) in the source
  dropdown and keep pending-change addresses visible.
- chat: insert emoji at the cursor position; restrict new-chat recipients to
  shielded (z) addresses.
- console: optional auto-focus of the command input on tab open (off by default).
- shutdown: when "stop external daemon" is on, keep the shutdown screen up until
  the external node actually exits, showing live status.

Adversarially reviewed; verified across full-node, lite, and Windows builds; tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/util/xmrig_updater.cpp

@@ -265,6 +265,7 @@ void XmrigUpdater::installResolved(const std::string& targetDir, const XmrigRele
     //    the archive bytes against that key, so a checksum rewritten in a tampered release body is
     //    not sufficient to install.
     setProgress(State::Verifying, "Verifying download…");
+    std::string bytes;   // kept in scope through extraction so we extract the VERIFIED buffer (I-01)
     {
         std::ifstream f(zipPath, std::ios::binary);
         if (!f) {
@@ -272,7 +273,7 @@ void XmrigUpdater::installResolved(const std::string& targetDir, const XmrigRele
             setProgress(State::Failed, "Could not read the downloaded archive.");
             return;
         }
-        const std::string bytes((std::istreambuf_iterator<char>(f)), std::istreambuf_iterator<char>());
+        bytes.assign(std::istreambuf_iterator<char>(f), std::istreambuf_iterator<char>());
         if (f.bad()) {
             fs::remove(zipPath, ec);
             setProgress(State::Failed, "Could not read the downloaded archive.");
@@ -333,7 +334,9 @@ void XmrigUpdater::installResolved(const std::string& targetDir, const XmrigRele
     const std::string minerName = wanted.front();  // "xmrig" / "xmrig.exe"
 
     mz_zip_archive zip{};
-    if (!mz_zip_reader_init_file(&zip, zipPath.c_str(), 0)) {
+    // Extract from the ALREADY-VERIFIED in-memory buffer, not by reopening zipPath — otherwise a fast
+    // local attacker could swap the file on disk between the hash/signature check and extraction. (I-01)
+    if (!mz_zip_reader_init_mem(&zip, bytes.data(), bytes.size(), 0)) {
         fs::remove(zipPath, ec);
         setProgress(State::Failed, "Could not open the downloaded archive.");
         return;