Audit: Ledger sign and onboarding overlays (Sherlock 227, 228, 259) #607

Tracking issue for the Ledger overlay findings from the Sherlock audit, targeted at v0.10.6.

• Sherlock #227 (General Health): the device-sign poll runs in the toolbar popup. Connecting there opens the grant tab, which closes the popup and orphans the session with the device still claimed. Every later attempt reports device-busy, and the grant tab has no idle expiry.
• Sherlock #228 (Low/Info): the device-sign takeover is never dismissed when its parked request disappears. After a lock it stays over the unlock screen, still showing the old hash.
• Sherlock #259 (Low/Info): the sign and onboarding takeovers share z-index: 40, so the onboarding overlay covers the hash comparison and Cancel.

Fix: tie the sign takeover's lifetime to the queue and to the panel surface, give the grant tab an idle expiry, and stack the sign prompt on top.