v0.78.0: DELETE /escrow/stage-secret — idempotent staged-secret wipe

The staged offsite repo password was wiped only by the escrow-create
ceremony; a confirm without a fresh ceremony (password already escrowed)
left the 0600 staged file behind. The controller calls this on every
EscrowState flip to escrowed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/localapi/server.go

@@ -314,6 +314,8 @@ func (s *Server) Handler() http.Handler {
 
 	// fork-4: stage the controller-pushed offsite restic repo password for the escrow-create ceremony.
 	mux.HandleFunc("POST /escrow/stage-secret", s.withGuest(s.handleStageEscrowSecret))
+	// fork-4 hygiene: wipe the staged secret once escrowed (controller calls this on confirm). Idempotent.
+	mux.HandleFunc("DELETE /escrow/stage-secret", s.withGuest(s.handleWipeStagedEscrowSecret))
 	return mux
 }