core: implement biometric-gated secure session vault with auto-lock

[EmeditWeb]

Problem

The app's security state is not durable. security.store.ts has zero
persistence (#39) — isLocked, failedAttempts, and biometricCheckDone
all reset to defaults on restart, so biometric lockout and idle auto-lock are
bypassed simply by killing and reopening the app. Sign-out is also
incomplete: settings.handleSignOut() clears user/auth state but never
disconnects the WalletConnect v2 session (#41), leaving an active session
after the user believes they are signed out.

Before Starting

Read ALL of these before writing any code:

• context/architecture-context.md
• context/code-standards.md

What To Build

A hardware-backed, persisted security vault:

1. Persist security state to encrypted storage (expo-secure-store / Keychain /
   Keystore) so lock status and failed-attempt counters survive restart.
2. Enforce failed-attempt lockout with backoff and idle auto-lock that cannot
   be reset by relaunching the app.
3. Gate protected screens behind a biometric check that re-runs on cold start
   and resume.
4. Make sign-out a full teardown: revoke the WalletConnect v2 session and
   clear wallet, auth, and loan stores atomically.

Files To Touch

• src/security/security.store.ts
• services/wallet.service.ts (session teardown)
• app/settings.tsx (handleSignOut)
• src/security/* (biometric gate, secure storage)

Acceptance Criteria

• Lock status and failed-attempt count persist across app restart
• Lockout backoff and idle auto-lock cannot be bypassed by relaunching
• Biometric gate re-runs on cold start and resume
• Sign-out revokes WalletConnect v2 session and clears all stores
• No secrets in plain AsyncStorage; secure storage used throughout
• Tests cover lockout persistence and full sign-out teardown

Mandatory Checks Before Opening PR

• All context/ files read and understood
• npx expo export --platform web passes
• No TypeScript errors
• No hardcoded hex colors (constants/colors.ts only)
• Icons from lucide-react-native only
• Loading, error, and empty states handled
• PR references this issue number

[morelucks]

i can i work on this

[ebubeb683-ship-it]

I have experience using React, I have looked through the project’s code, and I can submit a Pull Request (PR) with the fix within 2 days.”

[mubking]

Hi, I'm Mubaraq — a Full-Stack & Blockchain Developer with 3+ years of experience. I've reviewed this issue and I'm confident I can handle it. I'll submit a clean PR within 2–3 days. Please assign it to me!