Vault PIN: tie it to the TPM and never store it unsealed

Theseus's own quick-unlock PIN had the same limit as Aegis's: once the
DPAPI seal is opened (as the user, or from a disk image plus the
Windows password) the 6-digit PIN falls to an offline search. The PIN
is now also the authorization value of a Platform Crypto Provider TPM
key whose secret is mixed into the wrapping key, so the chip's lockout
bounds guessing; lib/tpm-pin.cjs is the same module Aegis uses.

set() now refuses when there is no real OS keystore (Linux basic_text
included) instead of writing the blob in the clear, an unsealed record
from an older build is deleted, and Settings says what the PIN actually
protects against on this machine.

lib/tpm-pin.js

@@ -19,7 +19,7 @@
 // by -EncodedCommand; the PIN and secrets travel only on stdin/stdout, never
 // on the command line.
 //
-// Shared with TheseusNavigator/lib/tpm-pin.cjs (same code) — keep them equal.
+// Shared with TheseusNavigator/lib/tpm-pin.cjs (same code apart from this line) — keep them equal.
 "use strict";
 
 const { spawn } = require("node:child_process");