feat(desktop): gate sign-out behind key backup + typed confirmation

[wesbillman]

Problem

Signing out wipes the identity key and all local data, but the confirm dialog was a single unguarded click — one red button between the user and permanent, irrecoverable key destruction.

Raised by Wes in improve-signout-safety.

Change

The dialog now requires two explicit steps before "Delete My Data" unlocks:

1. Back up the key — the nsec is shown inline (masked, reveal/copy via the existing NsecMaskedDisplay); the "I have saved my private key" checkbox only unlocks after the user actually reveals or copies the key. If the key can't be loaded (keychain error) the checkbox stays usable so sign-out is never soft-bricked.
2. Typed confirmation — the user must type wipe all my data (trimmed, case-insensitive).

Cancel remains the focused default (Radix AlertDialog), so Enter can never fire the wipe.

Implementation notes

• Sign-out section extracted from ProfileSettingsCard.tsx into a new SignOutSection.tsx, bringing ProfileSettingsCard back under the 1000-line ceiling; its TEMP file-size override is removed.
• The confirm button is a plain Button rather than AlertDialogAction: Radix's Action closes the dialog on click, which would drop the pending spinner while the wipe + restart is in flight.
• NsecMaskedDisplay gains an optional onKeyInteraction callback (fired on reveal/copy) so flows can gate on real interaction with the key.
• e2e mock bridge now handles sign_out (no-op; specs assert invocation via __BUZZ_E2E_COMMANDS__).

Tests

New signout-confirmation.spec.ts (registered in the smoke project):

• delete button unlocks only after backup + exact phrase (wrong phrase stays locked)
• reveal also unlocks the backup checkbox
• completing both gates invokes sign_out
• cancel resets all gates for the next open
• keychain-error degradation path still allows sign-out

Verified at d6023d1: pnpm typecheck, pnpm check, full pnpm test (3401 pass), and smoke e2e for the touched specs (14 pass).

Screenshots

New dialog — "Delete My Data" locked until both gates pass:

Settings section (unchanged entry point):

[wesbillman]

Princess Donut review at d6023d17686be567210d20cdd7c1b5f0e758a7c6: no blocking findings.

The two gates are independently enforced, only successful copy/reveal unlocks backup attestation, dialog state resets on cancel/failure, late get_nsec results are ignored after close, the destructive action cannot be submitted with Enter, and the keychain-error escape hatch avoids trapping the user. The extraction also preserves the prior success/failure storage-clearing behavior.

Verification at that SHA: git diff --check, typecheck, Biome/file-size guards, and the full desktop unit suite (3401/3401) passed locally. All required GitHub checks, including all four Desktop Smoke E2E shards, are green.

I attempted to record an approval, but the authenticated GitHub account is the PR owner, so GitHub correctly rejected self-approval.