feat(watchtower): cluster 4 — HIBP password breach detection [v2.0]

[pexatar]

Summary

Cluster 4 of the PassKey 2.0 plan — HIBP Watchtower: detect compromised passwords using the Have I Been Pwned Pwned Passwords API with the k-anonymity model (only the first 5 SHA-1 hex chars leave the device, never the password).

• IHibpService / HibpService — k-anonymity client, static HttpClient singleton, 5s timeout
• IWatchtowerScanService / WatchtowerScanService — scan orchestrator: 24h cache, 5 req/s throttle, UI-dispatched Progress/Completed events
• Opt-in — "Check for compromised passwords" toggle in Settings → Security, persisted via SettingsService (HibpEnabled, LastHibpScanUtc); localized consent dialog (4 keys × 6 languages)
• Refactor — standalone Watchtower folded into the Verifica page: "Password" and "Vault" tabs replace the old Audit Vault tab + Watchtower nav entry; WatchtowerView/ViewModel removed
• Dashboard — clickable "Salute del vault" card above the stat cards with Compromised/Weak/Reused mini-counters, navigates to Verifica/Vault
• Nav badge — red dot when compromised passwords exist
• Privacy policy — new "Compromised Password Check" section documenting k-anonymity + opt-in

Deviation from plan

T4.4 originally specified a dedicated WatchtowerView. Per user request during T4.GATE, Watchtower was instead merged into the existing Verifica page (T4.7 approach) to remove redundancy with the Audit Vault tab.

Plan note

This PR targets main but does not bump the version — the 2.0.0 bump and public release happen only in Cluster 8.

Test plan

• dotnet test — 213/213 green (14 new HibpServiceTests)
• T4.GATE manual test passed (menu, Verifica tabs, HIBP opt-in, scan with leaked password, offline scan)
• CI green

🤖 Generated with Claude Code