Remove DEBUG lock-screen bypass, add DEBUG mode policy

DEBUG mode must behave identically to normal mode except for
the red banner and hardcoded mnemonic. No other DEBUG branches
without explicit owner approval. Policy documented in README.

src/popup/index.js

@@ -287,11 +287,6 @@ async function init() {
 
     await loadState();
 
-    // In DEBUG mode, skip the lock screen (no encryption yet)
-    if (DEBUG && state.hasWallet) {
-        state.locked = false;
-    }
-
     if (!state.hasWallet) {
         showView("welcome");
     } else if (state.locked) {