fix: wipe the exported private key from the DOM on any view leave (closes #221)

README.md

@@ -491,6 +491,14 @@ ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
 so the popup can never reopen onto one of them with no password prompt in front
 of it.
 
+Every screen that holds secret material in the page registers a cleanup with
+`onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
+exit from that screen rather than only on its "Back" button, so nothing secret
+survives in a hidden view once the user has navigated away by any route. That
+covers the revealed private key and recovery phrase, the recovery phrase,
+private key or extended private key entered on AddWallet, and the password typed
+on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
+
 #### Welcome (`welcome`)
 
 - **When**: No wallets exist yet (`state.hasWallet` is false). This is the root
@@ -601,10 +609,15 @@ of it.
     - "Reveal" (correct password) → decrypts the wallet secret, derives this
       address's key, hides the password input and shows the key (no screen
       change)
-    - "Reveal" (wrong password) → "Wrong password." on the error line, nothing
-      revealed
-    - "Back" → clears the key and password from the DOM, then → previous screen
-      (AddressDetail)
+    - "Reveal" (wrong password) → full-sentence error on the error line, nothing
+      revealed (no screen change)
+    - "Back" → previous screen (AddressDetail)
+- **Secret handling**: nothing is decrypted, no key is derived, and nothing is
+  written into the page until the password is accepted; the key is never stored
+  in state, and it is wiped from the page whenever the screen is left by any
+  route, including the Settings gear. A decrypt still running when the screen is
+  left is discarded rather than written. The screen is not restorable, so
+  reopening the popup lands on Home rather than back on the key.
 
 #### AddressToken (`address-token`)