Address copilot pass 4 on #4

hideLwsAuthSection() reset memPrivKey/lastVmKid but left the
pasted value in the privkey <input> DOM element. If a user
re-ran diagnostics or switched to a different WebID, the
privkey could be silently reused on the wrong identity. Clear
privkeyInput.value too. (sign-out already does this; this
catches the diagnostic-re-run path.)

Author: melvincarvalho

doctor.js

@@ -405,6 +405,11 @@ function hideLwsAuthSection() {
   testSection.hidden = true;
   memPrivKey = null;
   lastVmKid = null;
+  // Clear the input element too — the in-memory privkey is gone but a
+  // pasted value would otherwise persist in the DOM across diagnostic
+  // re-runs / WebID switches and could be accidentally reused on a
+  // different identity.
+  privkeyInput.value = '';
 }
 
 oidcSignInBtn.addEventListener('click', async () => {