Lock bypass in SD-protect-only configuration allows signing after LockDevice/autolock

On devices configured with SD-card protection enabled and no PIN set, locking the device — manually or via auto-lock — did not fully re-engage the lock. The device could remain in an unlocked state and continue authorizing protected operations after the user expected it to be locked. The fix ensures lock and auto-lock apply correctly to SD-card-protection-only devices, so the SD-card secret must be presented again before protected operations can resume.