L14/COR-015: document verifyMainPassword real-vs-decoy intentionality

@@ -996,6 +996,12 @@996996   await persistSlotA();997997 }998998 999+// L14/COR-015: this function intentionally checks slot A (real vault) only.1000+// A duress-mode user attempting changePassword is rejected earlier by the1001+// vaultMode === 'decoy' check at changePassword. The real-vs-decoy1002+// distinction here is by design — duress users cannot rotate the real1003+// password by guessing it, and the asymmetry in error timing is acceptable1004+// because duress mode is opt-in and the user knows their own decoy key.9991005 export async function verifyMainPassword(password: string): Promise<boolean> {10001006   await ensureMigrated();10011007   const slotA = await loadSlot(SLOT_A);