Authenticator: cancelling a wipe destroys the TOTP secrets anyway

[BitHighlander]

Reproduced on signed v7.14.1 (sha256 f40fe1b74949a9e091269536b27cd53bbb8a5c1c428a6c36ff7d5c6bf6845f46, key slots 1/2/3).

What happens

getAccount:0                 -> 'keepkey.com:alice'        account present
wipeAuthdata + host Cancel   -> Success                    the wipe PROCEEDED
getAccount:0                 -> Failure 'Account not found' secret is GONE

The user's abort executed as a commit. Cancelling the wipe is what destroyed
every authenticator secret on the device.

Why it happens

wipeAuthData() calls confirm() and discards the result, then wipes
regardless. The same pattern affects the add and delete paths.

There is no reject button on this device, so a false from confirm() means
exactly one thing: the host sent a Cancel and the screen was taken away. That
is a refusal, and it was being ignored.

Corroborating detail

The pre-fix warning text read:

Do you want to PERMANENTLY delete all authenticator accounts?
If not, unplug Keepkey now.

That second sentence only makes sense if cancelling does not work — which is
what the code did. It is a comment on the defect, written into the UI.

Fix

Gate on the result:

if (!confirm(ButtonRequestType_ButtonRequest_Other, "Confirm Wipe Authdata",
             "Do you want to PERMANENTLY delete all authenticator accounts?")) {
  return CANCELED;
}

and drop the "unplug Keepkey now" sentence, which is no longer true.

Verified after the fix with the same before/after read: the cancel returns
Failure 'Action cancelled' and getAccount:0 still returns
keepkey.com:alice.

Fixed in the 7.14.2 security line.