feat: add state-machine for appLockflow [WPB-23186]

[e-maad]

WPB-23186 [Web] Applock forgot password - Users prompted to log out, log in, set new applock password

Summary

Added state machine for appLock flow
https://stately.ai/registry/editor/5b37cbe9-127b-4b50-b3bb-3ffec900e2b6?mode=Simulate&machineId=9d4336ce-95a7-47a3-94a5-2ee7288d31a3

Security Checklist (required)

• External inputs are validated & sanitized on client and/or server where applicable.
• API responses are validated; unexpected shapes are handled safely (fallbacks or errors).
• No unsafe HTML is rendered; if unavoidable, sanitization is applied and documented where it happens.
• Injection risks (XSS/SQL/command) are prevented via safe APIs and/or escaping.

Accessibility (required)

• I have read and this PR upholds our Accessibility Best Practices.

Standards Acknowledgement (required)

• I have read and this PR upholds our Coding Standards and Tech Radar Choices.

---

Screenshots or demo (if the user interface changed)

Notes for reviewers

• Trade-offs:
• Follow-ups (linked issues):
• Linked PRs (e.g. web-packages):

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.61%. Comparing base (c0b9bb5) to head (634e460).
⚠️ Report is 9 commits behind head on dev.

Files with missing lines	Patch %	Lines
...app/src/script/page/AppLock/appLockStateMachine.ts	90.00%	1 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              dev   #21005      +/-   ##
==========================================
+ Coverage   44.58%   44.61%   +0.02%     
==========================================
  Files        1696     1697       +1     
  Lines       43893    43923      +30     
  Branches     9036     9043       +7     
==========================================
+ Hits        19571    19597      +26     
- Misses      22269    22270       +1     
- Partials     2053     2056       +3     

Flag	Coverage Δ
app_webapp	42.66% <90.00%> (+0.03%)	⬆️
lib_api_client	51.88% <ø> (ø)
lib_core	58.88% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...app/src/script/page/AppLock/appLockStateMachine.ts	90.00% <90.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🔗 Download Full Report Artifact

🧪 Playwright Test Summary

• ✅ Passed: 14
• ❌ Failed: 0
• ⏭ Skipped: 0
• 🔁 Flaky: 0
• 📊 Total: 14
• ⏱ Total Runtime: 551.5s (~ 9 min 11 sec)

[screendriver]

I think this pull request would be easier to review and safer to roll back if the CI / dependency-management changes were separated from the product behavior changes. Right now the branch combines app-lock work with workflow and automation updates, which makes review scope larger than necessary.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[e-maad]

@screendriver, waiting for your review.

[screendriver]

This changes the current product behavior for optional app-lock setup.

DISABLE in setup is currently guarded by !context.isEnforced && context.isChangingPasscode, which means first-time setup cannot be cancelled after the user enables app lock. In the existing user interface that cancel path is allowed when app lock is optional and not yet activated.

[screendriver]

LOCK_ENFORCED only updates context in unprotected and unlocked. If enforcement changes while the machine is in setup, locked, forgotPasscode or wipeConfirm, context.isEnforced stays stale and later guard decisions can be wrong.