display: randomize PIN pad digits

[cofob]

What

Randomize all ten digit positions on the PIN pad for each PIN request to reduce PIN recovery from observed tapping patterns and touch traces. Randomization is enabled by default, with a persistent Settings → Display → Random PIN pad option to disable it.

The existing EF_DISPLAY record remains compatible by storing the fixed layout as an opt-out flag. Fixes #90.

How it was tested

• nix develop -c ./scripts/check.sh passes locally
• On hardware: manually tested, works as expected
• Host-only change (CLI / docs / CI) — no device behavior touched

Checklist

• Device behavior / image changed → config.device_release bumped from 0x095B to 0x095C
• A downgrade would restore the fixed-by-default PIN pad and reopen the touch-trace risk → consider advancing the rollback epoch for the next sealed release
• New or changed unsafe → N/A; none
• User-visible behavior → docs/guides/display.md and screenshots updated
• New files carry the SPDX header → N/A; no new files
• Commit messages use the zone prefix style: display: randomize PIN pad digits

[TheMaxMur]

Already implemented in #93