backup: keep Proton key passphrases, never the password

The stored session used to hold the mailbox password, which on a
single-password account is the login password. It now holds the per-key
passphrases derived from it at login, which unlock the keys but cannot
log in, change the password or turn 2FA off. Login also checks them
against the account's keys, so a wrong mailbox password fails there
rather than at the first backup.

A session stored by an older build is upgraded on the next start: its
key salts are already known, so the passphrases derive locally and the
file is rewritten without the password.

Cargo.toml

@@ -45,7 +45,7 @@ chrono-tz = "0.10"
 # opened a chunk at a time; Argon2id between the password and the key.
 aes-gcm = { version = "0.10", features = ["stream"] }
 argon2 = "0.5"
-zeroize = "1"
+zeroize = { version = "1", features = ["serde"] }
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
 
 proton-drive-rs = "0.9.2"