fix(security): require passphrases for local backups

Derive every MDD2 key from a non-empty user passphrase and the per-backup scrypt salt while keeping the embedded application material isolated to read-only MDD1 migration imports. Normalize missing, wrong, and authentication-failure results to the same controlled decryption error.

Add the modal-based export confirmation and format-aware import flow across renderer, preload, IPC, and controller boundaries. Clear transient passphrase state on completion or cancellation, retain pending import data only until consumption, and keep passphrases out of results, snapshots, payloads, and logs.

Cover mismatch and cancellation paths, MDD1 passphrase-free migration, preload forwarding, successful UI/crypto round-trips, one-byte-short ciphertext, authenticated empty ciphertext, and truncated legacy envelopes.

tests/visual/mock-electron-api.ts

@@ -171,7 +171,9 @@ export function createVisualElectronApi(
     restart: async () => {},
     quit: async () => {},
     exportBackup: async () => ({ saved: true }),
+    selectBackupImport: async () => ({ selected: true, requiresPassphrase: false }),
     importBackup: async () => ({ restored: true, relaunch: false, message: "Visual backup importiert" }),
+    cancelBackupImport: async () => {},
     exportOnlineBackup: async () => ({ key: "visual-online-backup-key" }),
     importOnlineBackup: async () => ({ restored: true, relaunch: false, message: "Visual online backup importiert" }),
     exportSupportBundle: async () => ({ saved: true, filePath: "C:\\Visual\\Support\\support.zip" }),