fix(cli): resolve second factor via shared helper for recovery-qr + backup (key-file parity); wasm equivalence negative control

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01McMF5pUJbCMricmFEnf2sG

crates/relicario-wasm/src/lib.rs

@@ -670,6 +670,16 @@ mod session_tests {
             extract(h_key.value()),
             "key-file path must derive the identical master key as the stego-image path"
         );
+
+        // Negative control: a DIFFERENT secret must derive a DIFFERENT master key
+        // (guards against a hypothetical constant/secret-insensitive KDF regression).
+        let h_other = unlock_with_secret("correct horse", &[4u8; 32], &salt, params)
+            .expect("unlock_with_secret other");
+        assert_ne!(
+            extract(h_img.value()),
+            extract(h_other.value()),
+            "a different secret must derive a different master key"
+        );
     }
 
     #[test]