feat: an "Allow weak passwords" setting lets a new wallet have a short password (closes #674)

Settings has a new "Allow weak passwords" checkbox, off in a new profile. While it is off, AddWallet refuses a password shorter than 12 characters, as before. While it is on, AddWallet accepts any password that is not empty. Key derivation is unchanged: one Argon2id derivation at libsodium's interactive setting. README's Key Decisions now states those parameters and why one light derivation is enough: the password's length is what protects the stored secret.

The screens say "password", as README's wording rules require, so the setting is "Allow weak passwords".

Model: opus-5-5

src/popup/views/addWallet.js

@@ -132,7 +132,8 @@ function validatePassword() {
         showError("add-wallet-password-error", "Please choose a password.");
         return null;
     }
-    if (pw.length < 12) {
+    // "Allow weak passwords" in Settings lifts the 12-character minimum.
+    if (!state.allowWeakPasswords && pw.length < 12) {
         showError(
             "add-wallet-password-error",
             "Password must be at least 12 characters.",

src/popup/views/settings.js

@@ -499,6 +499,12 @@ function init(_ctx) {
         await saveState();
     });
 
+    $("settings-allow-weak-passwords").checked = state.allowWeakPasswords;
+    $("settings-allow-weak-passwords").addEventListener("change", async () => {
+        state.allowWeakPasswords = $("settings-allow-weak-passwords").checked;
+        await saveState();
+    });
+
     $("btn-main-add-wallet").addEventListener("click", ctx.showAddWalletView);
 
     $("btn-settings-add-token").addEventListener(