Extract handleUnlock from popup-only.ts handle() switch, add keyfile branch (keyfile_decode + unlock_with_secret), forward-compat guard for unknown second_factor values, loadKeyfileBase64 helper, loadSetupState isConfigured fix for keyfile vaults. Register error copy for three new error codes. Un-skip Task 4 TDD test — 440/440 green, build clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014THSV6cA4Gxa7bxFfisHBB