[HIGH] Onboarding "download backup" writes the mnemonic as unencrypted JSON named after the public handle

Summary

handleDownloadBackup calls activeSphere.exportToJSON({ includeMnemonic: true }) with no password, producing a cleartext-seed file named ${nametag}.json — trivially identifiable. The in-wallet "Save Wallet" export properly uses exportToJSON({ password, includeMnemonic: true }) (L3WalletView.tsx:253). Onboarding is inconsistent with it.

Where

src/components/wallet/onboarding/hooks/useOnboardingFlow.ts:685.

Fix

Reuse the SaveWalletModal (filename + password) in onboarding, or at minimum warn that the file contains the unencrypted recovery phrase and do not name it after the public handle.

Found by multi-agent audit @ main b477d4d7; adversarially verified. Fix is app-side.