Wire sensitive-field-warning-dialog into EncryptedFieldDisplay

Convert EncryptedFieldDisplay to a StatefulWidget (or use a ConsumerStatefulWidget if Riverpod is the DI approach) to manage the _isRevealed and _isDecrypting booleans and the _plaintextValue String?. The confirm callback from SensitiveFieldWarningDialog should `await showModalBottomSheet(...)` — the dialog calls Navigator.pop(true) on confirm and Navigator.pop(false) (or nothing, which defaults to null) on dismiss. Treat null result the same as false. In the confirm branch: set _isDecrypting = true, call compute(_decrypt, args) where _decrypt is a top-level function taking (ciphertext, key), then on result set _isRevealed = true and _plaintextValue = result.

In the catch branch, show ScaffoldMessenger.of(context).showSnackBar with a generic message ('Unable to reveal field — please try again'). Override dispose() to set a _mounted guard to prevent setState after disposal. Do not store the decryption key in widget state; re-derive it from the session token on each reveal.

Widget tests (flutter_test): (1) tap lock icon → assert SensitiveFieldWarningDialog is present in the widget tree; (2) confirm dialog → mock decryptField to return 'test value' → assert plaintext 'test value' is visible and lock icon is replaced by unlock icon; (3) dismiss dialog via Navigator.pop(false) → assert widget remains in masked state and decryptField is never called; (4) mock decryptField to throw DecryptionFailure → confirm dialog → assert SnackBar with user-friendly error appears and field stays masked; (5) tap unlock icon while in revealed state → assert field returns to masked state and plaintext is no longer in the widget tree. All tests use pumpAndSettle() after async operations.