add shared/native.ts (isNativePlatform, nativePlugin); App.tsx subscribes to Capacitor App appStateChange and locks vault when background elapsed >= autoLockMinutes

@@ -25,6 +25,7 @@2525   type ShortcutAction,2626 } from "../shared/shortcuts";2727 import { generateTOTP } from "../crypto/totp";28+import { isNativePlatform, nativePlugin } from "../shared/native";2829 2930 export { sendMessage } from "../shared/bridge";3031 @@ -413,6 +414,39 @@413414       popupPort = chrome.runtime.connect({ name: "popup" });414415     } catch { /* extension context invalidated — ignore */ }415416     onCleanup(() => { try { popupPort?.disconnect(); } catch {} });417+418+    // Android autolock. chrome.alarms is no-op'd on Capacitor, so the only419+    // reliable signal is appStateChange — setTimeout is killed when the OS420+    // backgrounds the app. We measure elapsed background time on resume.421+    if (isNativePlatform()) {422+      let backgroundedAt: number | null = null;423+      const CapApp = nativePlugin<{424+        addListener: (425+          ev: string,426+          cb: (s: { isActive: boolean }) => void,427+        ) => Promise<{ remove: () => Promise<void> }> | { remove: () => Promise<void> };428+      }>("App");429+      if (CapApp?.addListener) {430+        const sub = CapApp.addListener(431+          "appStateChange",432+          ({ isActive }: { isActive: boolean }) => {433+            if (!isActive) {434+              backgroundedAt = Date.now();435+              return;436+            }437+            if (backgroundedAt !== null && autoLockMinutes() > 0) {438+              const elapsed = Date.now() - backgroundedAt;439+              if (elapsed >= autoLockMinutes() * 60_000) handleHeaderLock();440+            }441+            backgroundedAt = null;442+          }443+        );444+        // Capacitor 6 listeners return a Promise<{ remove: () => Promise<void> }>.445+        onCleanup(() => {446+          Promise.resolve(sub).then((s) => s?.remove?.()).catch(() => {});447+        });448+      }449+    }416450 417451     // Background auto-lock broadcasts VAULT_LOCKED so the popup drops stale418452     // entries instead of waiting for the next GET_ENTRIES round-trip.