chore(deps): proton-sdk and proton-drive-rs 0.9.0

Adapt sign-in to the 0.8 account API and use what it adds:

- Key passphrases are KeyPassphrases now, wiped on drop. The stored
  session keeps its JSON shape and converts on unlock.
- The mailbox password is checked with AccountClient::unlock(), one
  core/v4/users request instead of loading every address, and a wrong
  one is recognised as ProtonError::KeysLocked instead of any
  InvalidOperation.
- KeysLocked from a resumed session counts as signed out: the mailbox
  password changed, and only signing in again derives passphrases that
  unlock the keys.
- A sign-in Proton answers with code 2028 (Blocked) says so, instead of
  showing the server text that claims the app version is outdated.

Also picked up without code changes: a token refresh that outlives its
caller and is never replayed (0.8.2).

crates/pstr-core/src/error.rs

@@ -85,11 +85,14 @@ impl Error {
     }
 
     /// Whether this is the account's session having ended: the refresh token
-    /// was revoked or expired, or the token lacks a scope only a password
-    /// sign-in grants. Nothing but signing in again fixes it.
+    /// was revoked or expired, the token lacks a scope only a password
+    /// sign-in grants, or the stored key passphrases no longer unlock the
+    /// account because its mailbox password changed. Nothing but signing in
+    /// again fixes it.
     pub fn is_signed_out(&self) -> bool {
         match self {
             Self::SignedOut(_) => true,
+            Self::Drive(proton_sdk::error::ProtonError::KeysLocked) => true,
             Self::Drive(proton_sdk::error::ProtonError::Api(api)) => {
                 api.is_invalid_refresh_token() || api.is_insufficient_scope()
             }
@@ -127,4 +130,10 @@ mod tests {
             "io: client error (SendRequest): connection closed before message completed"
         );
     }
+
+    #[test]
+    fn stored_passphrases_that_no_longer_unlock_mean_signed_out() {
+        let error = Error::Drive(proton_sdk::error::ProtonError::KeysLocked);
+        assert!(error.is_signed_out());
+    }
 }