feat: add secure-storage module (Tink + Android Keystore)

[maniramezan]

What

Adds a new published module io.github.maniramezan.compose:secure-storage — an encrypted key-value store backed by Google Tink AEAD with a master key sealed in the Android Keystore. It's the Android equivalent of iOS Keychain for small secrets (tokens, session metadata, feature flags) that must survive process death.

Replaces the need for the deprecated androidx.security:security-crypto (EncryptedSharedPreferences, sunset April 2024).

API

val storage = SecureStorage.create(context)          // Keystore-backed
storage.putString("token", value)
val value = storage.getString("token")               // null if absent/undecryptable

• SecureStorage interface + AeadSecureStorage (AES256-GCM; the entry key is bound as associated data, so ciphertext can't be replayed under another key).
• A KeyValueStore seam keeps the crypto unit-testable without the Android framework or Keystore.

Consumer testing

Consumers depend on the SecureStorage interface (not create()) and inject InMemorySecureStorage in tests — public, dependency-free, pure-JVM, no Keystore/Robolectric required:

val storage: SecureStorage = InMemorySecureStorage()
val repo = TokenRepository(storage)        // class under test
repo.save("token-123")
assertEquals("token-123", storage.getString("auth.token"))

Tests (16, all green)

• AeadSecureStorageTest (8) — round-trip, encrypted-at-rest, overwrite, remove, clear, tamper→null, key-binding (software AEAD + in-memory store).
• InMemorySecureStorageTest (5) — test-double contract + defensive byte-array copies.
• SharedPreferencesKeyValueStoreTest (3) — persistence seam via Robolectric (@Config(sdk = 35)).
• Not unit-tested: SecureStorage.create() Keystore wiring — belongs in an instrumented test, not a fake.

Wiring

• settings.gradle.kts include, version catalog (Tink 1.21.0), vanniktech POM metadata (secure-storage/gradle.properties).
• Added to the binary-compatibility-validator ignore list, consistent with the other published modules.

Release

First consumer is the Novalingo Android app (Firebase auth session-hint persistence). Landing this feat: lets release-please cut 0.7.0 and publish to Maven Central.

Verification (local, mirrors CI)

• ./gradlew check ✅
• :catalog:assembleDebug :sample:assembleDebug :baselineprofile:assembleDebug ✅
• mkdocs build --strict ✅