expand hidden vault threat model in duress settings — clarifies what it protects against and what it doesn't

@@ -791,7 +791,7 @@791791           <Show when={duressEnabled() && !showDuressSetup()}>792792             <div class="peach-settings-row peach-settings-row--meta">793793               <span class="peach-settings-value" style="font-size:11px;line-height:1.5;color:var(--peach-t2)">794-                If someone forces you to unlock Peach, enter the duress password instead. A decoy empty vault opens; your real vault stays hidden.794+                If someone forces you to unlock Peach, enter the duress password instead. A decoy empty vault opens; your real vault stays hidden. The encrypted storage is identical in size whether a hidden vault exists or not, so the hidden vault cannot be proven or disproven without both passwords. This protects against a coercer who demands your password — not against device malware or someone who already has your device unlocked.795795               </span>796796             </div>797797           </Show>