feat: an "Allow weak passwords" setting lets a new wallet have a short password (closes #674)

Settings has a new "Allow weak passwords" checkbox, off in a new profile. While it is off, AddWallet refuses a password shorter than 12 characters, as before. While it is on, AddWallet accepts any password that is not empty. Key derivation is unchanged: one Argon2id derivation at libsodium's interactive setting. README's Key Decisions now states those parameters and why one light derivation is enough: the password's length is what protects the stored secret.

The screens say "password", as README's wording rules require, so the setting is "Allow weak passwords".

Model: opus-5-5

src/shared/persistedState.js

@@ -56,6 +56,9 @@ const DEFAULT_STATE = {
     // else.
     useBlockscout: false,
     checkRecipientsOnEtherscan: false,
+    // "Allow weak passwords" in Settings. While it is off, AddWallet refuses a
+    // password shorter than 12 characters.
+    allowWeakPasswords: false,
     fraudContracts: [],
     tokenHolderCache: {},
     theme: "system",
@@ -418,6 +421,9 @@ function normalizePersisted(saved) {
     // service.
     out.useBlockscout = saved.useBlockscout === true;
     out.checkRecipientsOnEtherscan = saved.checkRecipientsOnEtherscan === true;
+    // Anything but true is off: the setting lets AddWallet accept a short
+    // password.
+    out.allowWeakPasswords = saved.allowWeakPasswords === true;
     // A list of contract addresses, floored the same way: send.js builds its
     // fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
     // and filterTransactions() maps the same list through normalizeAddress(),