L1/THREAT-004: add isUnlocked guard to GET_ENTRIES handler

@@ -527,6 +527,7 @@527527       case "HAS_VAULT":528528         return { ok: true, data: await vault.hasVault() };529529       case "GET_ENTRIES":530+        if (!vault.isUnlocked()) return { ok: false, error: "vault_locked" };530531         return { ok: true, data: vault.getEntries() };531532       case "ADD_ENTRY": {532533         if (!vault.isUnlocked()) return { ok: false, error: "vault locked" };