0.114.16 — Per-folder encryption fixes (review follow-up)

Follow-up fixes from a review of the 0.114.15 per-folder encryption release.

Fixed: the per-folder "Lock now" button encrypted the whole folder instead of just forgetting the password from memory. It's now "Lock (forget password)" and only drops the in-memory key (you re-enter the password on next access). Encrypting or decrypting a folder's notes is the "Encrypt this folder's notes" toggle. The redundant "Unlock all" button was removed.
Key hygiene: rotating a folder's key now wipes the old key from memory; the encrypted-note export wipes its in-memory decrypted copy after writing; the export subfolder setting is sanitized against path escapes; the vault-wide unlock clears its cached key copies.

All 0.114.15 features (per-folder passwords, key rotation, encrypted-note export) are unchanged otherwise.