fix: hardening fixes from full-codebase review

[KristianP26]

Summary

A batch of correctness, security, and responsiveness fixes from a full review of the codebase. Each change is an isolated commit.

Security

• Custom headers now stored via DPAPI instead of plaintext settings.ini (they routinely carry tokens such as X-Api-Key). Stale plaintext values from older versions are purged on the next save so they cannot shadow the encrypted ones.
• Startup force-purges lingering plaintext secrets — new has_plaintext_secrets() detects secret keys an older version left in settings.ini and forces a save at startup (values are preserved, just re-persisted via DPAPI), so the purge no longer waits for the first manual settings save.
• API key fields no longer auto-reveal on focus. They stay masked; a trailing eye toggle reveals the value only on demand.

Correctness

• Settings dialog validates on every accept path — previously a direct accept() call bypassed both validation and the startup-registration sync.
• Disabling Screamer mid-recording now discards the recording instead of transcribing it and typing the result into the focused window.
• Disabling Screamer mid-processing now cancels the pipeline — the worker checks the cancel event before each step, so nothing gets typed after the user hits Disable.
• Late calibration results are dropped when the settings dialog closes — done() disconnects the result slots before waiting on the calibration thread, so a slow calibration can no longer deliver into a closing dialog.
• Frozen builds read .env next to the exe — apps launched from the Run key inherit an unpredictable cwd, so the file shipped next to the binary was silently missed.
• Groq rewrite ceiling raised 1024 → 4096 tokens — dictations over ~2700 chars always hit finish_reason=length and silently lost their cleanup.

Resource & responsiveness

• Worker threads are released after each dictation (finished → deleteLater); previously one QThread object leaked per recording.
• RMS calibration runs off the UI thread — the 2-second blocking recording froze the whole settings dialog.
• Text injection is one batched SendInput call instead of two syscalls per UTF-16 unit: faster for long transcripts and atomic with respect to concurrent user keystrokes.
• Startup no longer rewrites settings.ini/keys.enc when the .env import changed nothing (unless plaintext secrets need purging, see above).

Minor

• Reveal-toggle eye icon follows the palette text color — visible on dark themes (was painted with the default black pen).
• Documented partial-SendInput semantics: a failed batch means a prefix of the text was already typed; there is no rollback.
• Documented why a primary NO_SPEECH result intentionally skips the STT fallback.
• Direct config.stt_language access in rewrite.py (defensive getattr removed).
• Calibration test is now deterministic (QSignalSpy + release event instead of a processEvents/sleep poll loop).
• Implementation docs updated to match.

Test plan

• python -m compileall src/ tests/ clean.
• Full suite (python -m unittest discover -s tests, offscreen Qt, Windows): 105 tests pass, including new coverage for the cap scaling, UTF-16 splitting, discard-on-disable, cancel-on-disable-while-processing, startup-save skip, startup plaintext-secret purge, frozen .env path, header encryption + stale-ini purge, accept-path validation, password-field toggle, threaded calibration, and dropped late calibration results on dialog close.
• Manual smoke on Windows: batched SendInput types correctly (python -m src.injector), python -m src.config DPAPI roundtrip OK.