fix Codex VAULT_LOCKED redirect and Aztec roundtrip decode failures

@@ -1388,6 +1388,7 @@13881388                   onBack={() => setView("settings")}13891389                   onUpgradePro={() => { setSettingsInitialSection("license"); setView("settings"); }}13901390                   onOpenSecurity={() => { setSettingsInitialSection("security"); setView("settings"); }}1391+                  onVaultLocked={() => handleLock()}13911392                 />13921393               </Suspense>13931394             </Show>

@@ -106,7 +106,10 @@106106     text: payload,107107     eclevel: AZTEC_ECC_PERCENT.toString(),108108     scale: 4,109-    padding: 0,109+    // padding: 2 adds 8px (2 modules at scale 4) of quiet zone on each side.110+    // ZXing's finder pattern search fails when the code is flush against the111+    // image edge with no quiet zone, causing spurious AZTEC_ROUNDTRIP_FAILED.112+    padding: 2,110113     monochrome: true,111114   } as const;112115 @@ -236,10 +239,10 @@236239   }237240 238241   // @zxing occasionally returns null on a valid barcode due to transient239-  // rasterisation issues. Three attempts avoids aborting a full Codex build242+  // rasterisation issues. Five attempts avoids aborting a full Codex build240243   // for a momentary DOM hiccup. Content-mismatch is never retried.241244   let decoded: string | null = null;242-  for (let attempt = 0; attempt < 3; attempt++) {245+  for (let attempt = 0; attempt < 5; attempt++) {243246     decoded = await decodeAztecFromPng(image.pngBytes);244247     if (decoded !== null) break;245248   }

@@ -39,6 +39,7 @@3939   onBack: () => void;4040   onUpgradePro: () => void;4141   onOpenSecurity: () => void;42+  onVaultLocked: () => void;4243 }4344 4445 type Step = "words" | "generating" | "done";@@ -78,6 +79,12 @@7879     })) as { ok: boolean; data?: CodexVaultSnapshot; error?: string };7980 8081     if (!res.ok || !res.data) {82+      // Service worker restarted (MV3) and the vault re-locked in memory.83+      // Route back to the lock screen exactly like the rest of the app does.84+      if (res.error?.startsWith("VAULT_LOCKED")) {85+        props.onVaultLocked();86+        return;87+      }8188       setLoadError(res.error ?? "could not load vault data");8289       setLoading(false);8390       return;@@ -248,6 +255,7 @@248255       const code = (codexErr && (codexErr as { code?: string }).code) ?? "";249256       const message =250257         err instanceof Error ? err.message : "Codex generation failed.";258+      console.error("[Codex] generation failed:", code, message);251259       setGenError(explainCodexError(code, message));252260       setStep("words");253261     }