Refactor app services and stabilize refresh/UI flows

- Add refresh scheduler and network refresh service boundaries for typed
  refresh results, ordered RPC collectors, applicators, and price parsing.
- Add daemon lifecycle and wallet security workflow helpers while preserving
  App-owned command RPC, decrypt, cancellation, and UI handoff behavior.
- Split balance, console, mining, amount formatting, and async task logic into
  focused modules with expanded Phase 4 test coverage.
- Fix market price loading by triggering price refresh immediately, avoiding
  queue-pressure drops, tracking loading/error state, and adding translations.
- Polish send, explorer, peers, settings, theme/schema, and related tab UI.
- Replace checked-in generated language headers with build-generated resources.
- Document the cleanup audit, UI static-state guidance, and architecture updates.

src/services/wallet_security_controller.h

@@ -0,0 +1,93 @@
+#pragma once
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+
+namespace dragonx {
+namespace services {
+
+class WalletSecurityController {
+public:
+    enum class PinValidationError {
+        None,
+        Empty,
+        Mismatch,
+        TooShort,
+        NonDigit
+    };
+
+    struct PinValidationResult {
+        bool ok = false;
+        PinValidationError error = PinValidationError::None;
+        const char* message = "";
+    };
+
+    struct DeferredEncryptionSnapshot {
+        std::string passphrase;
+        std::string pin;
+    };
+
+    class RpcGateway {
+    public:
+        virtual ~RpcGateway() = default;
+        virtual bool encryptWallet(const std::string& passphrase, std::string& error) = 0;
+        virtual bool unlockWallet(const std::string& passphrase, int timeoutSeconds, std::string& error) = 0;
+        virtual bool exportWallet(const std::string& fileName, long timeoutSeconds, std::string& error) = 0;
+        virtual bool importWallet(const std::string& filePath, long timeoutSeconds, std::string& error) = 0;
+    };
+
+    class VaultGateway {
+    public:
+        virtual ~VaultGateway() = default;
+        virtual bool storePin(const std::string& pin, const std::string& passphrase) = 0;
+    };
+
+    enum class KeyKind {
+        Transparent,
+        Shielded
+    };
+
+    struct DeferredEncryptionResult {
+        bool encrypted = false;
+        bool pinProvided = false;
+        bool pinStored = false;
+        bool restartRequired = false;
+        std::string error;
+    };
+
+    ~WalletSecurityController();
+
+    void beginDeferredEncryption(std::string passphrase, std::string pin = {});
+    bool hasDeferredEncryption() const { return deferred_.pending; }
+    DeferredEncryptionSnapshot deferredEncryption() const;
+    bool shouldAttemptDeferredConnect(double nowSeconds, double minIntervalSeconds = 3.0);
+    void clearDeferredEncryption();
+
+    DeferredEncryptionResult runDeferredEncryption(DeferredEncryptionSnapshot request,
+                                                   RpcGateway& rpc,
+                                                   VaultGateway* vault);
+
+    static PinValidationResult validatePinSetup(const std::string& pin,
+                                                const std::string& confirmation,
+                                                bool allowEmpty = false,
+                                                std::size_t minLength = 4);
+    static KeyKind classifyAddress(const std::string& address);
+    static KeyKind classifyPrivateKey(const std::string& key);
+    static const char* importSuccessMessage(KeyKind kind);
+    static std::string decryptExportFileName(std::uint64_t timestampSeconds);
+    static void secureClear(std::string& value);
+
+private:
+    struct DeferredEncryptionState {
+        std::string passphrase;
+        std::string pin;
+        bool pending = false;
+        double lastConnectAttempt = -10.0;
+    };
+
+    DeferredEncryptionState deferred_;
+};
+
+} // namespace services
+} // namespace dragonx