Release 1.2.1 — crypto Result API, updater integrity, UX hardening

Crypto
- `crypto::encrypt` / `crypto::decrypt` now return `Result<_, CryptoError>`
  instead of panicking or returning `Option`. `derive_keys` accepts
  explicit Argon2 parameters and propagates errors. All integration and
  unit tests updated to the new signatures.

Updater
- Verify release asset integrity with SHA256SUMS.txt before replacing
  the running binary. The file is fetched from the GitHub release and
  matched against a freshly-computed hash of the download.
- Use `env!("CARGO_PKG_VERSION")` instead of a hard-coded version string.

UI
- Redesigned unlock dialog (centered layout, description, updated fonts),
  kept the 5-attempt lockout behaviour.
- Wrap password candidates in `zeroize::Zeroizing` in the create-password
  dialog so the inputs are wiped on drop regardless of branch taken.
- Gracefully surface encryption failures from the initial save path via
  a modal instead of silently dropping the error.
- Fix `unused_must_use` on `ShowWindow(...)` restore calls in main.rs and
  editor.rs.

Author: ctardy

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "locknote"
-version = "1.2.0"
+version = "1.2.1"
 edition = "2021"
 description = "Self-contained encrypted notepad for Windows"
 authors = ["Chris Tardy"]