fix(verifier): a secure field's typed value never reaches the record

A folio login run wrote the account email and password in cleartext into
llm-calls.jsonl, 166 times in one run, beside screenshots of the same
screens. Three sites rendered it: the recent-action memory, the candidate
list, and the trace. One helper now covers all three so a fourth cannot
bypass it, and the driver still receives the real text.

Android redacts every typed value because it cannot tell a secure field
from any other. That asymmetry is deliberate and documented: safe by
default on the target that cannot tell.

internal/verifier/extractor_encoding_test.go

@@ -43,6 +43,7 @@ const canonicalElement = `{
 	"enabled": true,
 	"focused": false,
 	"id": "TxnAmountField",
+	"secure": null,
 	"selected": false,
 	"text": "199",
 	"x": 200,