Duress PIN (panic/erase) to wipe device + SD

Add an optional "Duress PIN" (panic PIN) feature that, when entered in the lockscreen (or via a special combo), triggers an immediate or delayed wipe of the device and optionally the SD card.

Use case When a user is forced to unlock the device, entering the duress PIN will erase sensitive data and the SD card to protect against compromise.

Proposed behavior

• Feature is disabled by default.
• User can enable and configure in Settings → Security:
  • Duress PIN (set/change)
  • Action: wipe device / wipe device + SD
  • Delay: immediate (0s) or delayed N seconds with cancel option
• Duress PIN is stored as a hash in secure storage (NVS).
• Wipe uses existing device erase APIs (wipe credentials, NVS, etc.) and deletes files on SD (optionally overwrite).
• Add UI warnings and an "Are you sure?" flow when enabling the feature.

Security considerations

• Feature is destructive; must be opt-in and confirmed.
• Provide guidance in the docs about backups and risks.