PINs are now securely stored as SHA-256 hashes instead of plain text.
The raw PIN is never exposed to the client after being saved.
Client-side unlock uses hash comparison (sha256(inputPIN) === storedHash), improving the privacy and safety of user credentials.
sha256(inputPIN) === storedHash
Auto-lock and inactivity timer now persist across page refreshes using sessionStorage.
sessionStorage
Ensures the lock screen reappears even if the user reloads the browser tab.