PIN Storage Security Remediation

• [x] Investigation evidence collected.
• [x] Official Android Keystore behavior verified.
• [x] Implement hardware-backed PIN envelope and limited-use attempt gates.
• [x] Add focused tests and version bump.
• [x] Run full unit tests, lint, and release builds.
• [ ] Complete real-device validation and publish device-tier guarantees.

Checkpoint

• [ ] No ordinary-storage PIN-derived value can decrypt or validate the vault without Keystore hardware.
• [ ] StrongBox/TEE/unsupported behavior is evidenced on real devices.