kv-wasm: forget the Secret Key on logout and on any failed unlock or login

Co-Authored-By: Claude Opus 5.5 <[email protected]>

crates/kv-wasm/tests/sync.rs

@@ -247,6 +247,13 @@ async fn web_vault_enrolls_by_ticket_both_ways() {
     reloaded.unlock(PW, &sk).unwrap();
     assert_eq!(reloaded.setup_payload_for_kit().unwrap(), kit);
     web.unlock(PW, &sk).unwrap();
+    // A failed unlock (or login) forgets it until the next one that succeeds.
+    assert!(matches!(web.unlock("wrong password!!", &sk), Err(CoreError::BadCredentials)));
+    assert!(matches!(web.setup_payload_for_kit(), Err(CoreError::Locked)));
+    web.unlock(PW, &sk).unwrap();
+    assert!(web.login("wrong password!!", &sk, None).await.is_err());
+    assert!(matches!(web.setup_payload_for_kit(), Err(CoreError::Locked)));
+    web.unlock(PW, &sk).unwrap();
 
     // Single use: another browser with the same QR waits for approval.
     let (_, third) = new_web(&server);
@@ -273,6 +280,10 @@ async fn web_vault_enrolls_by_ticket_both_ways() {
     let (_, late) = new_web(&server);
     let setup = kv_wasm::core::parse_setup_payload(&add.payload).unwrap();
     assert_eq!(late.login_with_setup(&setup, PW).await.unwrap(), LoginResult::PendingApproval);
+
+    // Logging out forgets the Secret Key too.
+    web.logout().await.unwrap();
+    assert!(matches!(web.setup_payload_for_kit(), Err(CoreError::Locked)));
 }
 
 #[tokio::test]