feat(account): hold key passphrases as wiped secrets and report a locked account as KeysLocked

A wrong mailbox password surfaced as InvalidOperation("no active user key could
be unlocked"), which a caller could only recognise by its text. It is now
ProtonError::KeysLocked, and AccountClient::unlock() checks a secret with a
single core/v4/users request instead of loading every address.

Derived passphrases, the mailbox password and the cache encryption key were
plain Vec<u8>s, cloned freely and never wiped. They are Zeroizing now, and the
passphrase map is KeyPassphrases: wiped on drop, redacted in Debug, with
derive_secret() for a client that wants a key only an unlocked account can
reproduce. with_key_passphrases takes it.

Breaking: ProtonError gains a variant, key_passphrases() and
with_key_passphrases() change type, and derive_key_passphrase returns
Zeroizing<Vec<u8>>.

Cargo.lock

@@ -2060,7 +2060,7 @@ dependencies = [
 
 [[package]]
 name = "proton-drive-rs"
-version = "0.7.4"
+version = "0.8.0"
 dependencies = [
  "async-trait",
  "base64 0.23.1",
@@ -2085,7 +2085,7 @@ dependencies = [
 
 [[package]]
 name = "proton-sdk"
-version = "0.7.4"
+version = "0.8.0"
 dependencies = [
  "aes-gcm 0.11.1",
  "async-trait",
@@ -2112,6 +2112,7 @@ dependencies = [
  "thiserror 2.0.21",
  "tokio",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]