Make reset-card confirmation immediate

[acgxv]

Summary

• make the first reset-card click a local-only five-second confirmation
• resolve and consume the exact opaque card ID in one isolated app-server session on the second click
• preserve the resolved ID and idempotency key across ambiguous retries

Validation

• DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer swift test --package-path apps/decodex-app (100 tests)
• DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer swift build --package-path apps/decodex-app -c release
• independent read-only code review

Note

The existing app staging script still references the retired Cargo package named decodex; this pre-existing packaging issue is outside this Swift-only change.