Implement login timeout

The user needs to log in whenever they connect the device, but it probably shouldn't stay logged in indefinitely if the user is idle for a while. However, a lot of the cryptex's convenience depends on being able to quickly send passwords without the hassle of doing a full login every time. So, maybe there can be some sort of a PIN that the user can enter from the cryptex hardware interface (using buttons + rotary knob), with increasing timeouts between failed attempts, and, finally, forcing the user to do a full login again if there are too many failed PIN attempts. Definitely a balance between security and convenience.

The issue names no files, tests, or entry points. Start by locating the existing login and session handling plus the cryptex hardware input code; clarify the timeout, PIN, retry, lockout, and full-login behavior before implementation, then add tests covering the agreed security and convenience rules.

Written by the indexing model from the issue text.