security(wallet): encrypt MMKV wallet vault with device-bound keychai… - #134

Summary

Closes #122

— walletVault was opening a plaintext MMKV instance (new MMKV({ id: 'wallet-vault' })), so every Stellar secret seed was written as cleartext to the device's MMKV flat-file, exposed to rooted devices / ADB pull / backup extraction.

This encrypts the wallet vault with an AES key that is generated per-device and bound to the OS secure enclave (iOS Keychain / Android Keystore via react-native-keychain), and transparently migrates any existing plaintext secrets.

Changes

• src/services/walletVault.ts:
  • Derive a 32-byte key with crypto.getRandomValues and store it in the secure enclave (WHEN_UNLOCKED_THIS_DEVICE_ONLY, SECURE_HARDWARE), with an ANY/software fallback for Android < API 23.
  • Open MMKV with new MMKV({ id: 'wallet-vault-secure', encryptionKey: key }).
  • initWalletVault() (async, idempotent) loads/creates the key, builds the encrypted store, and runs a one-time migration: copy every secret:* key from the legacy plaintext wallet-vault instance into the encrypted instance → delete from legacy → MMKV.removeMMKV('wallet-vault') removes the plaintext file (guarded by a migration flag).
  • Public saveSecret / getInAppSecret / hasInAppSecret / clearInAppSecret remain synchronous; the secret value is never logged or written to JS state / Zustand.
• App.tsx — calls initWalletVault() at startup.
• package.json — react-native-keychain added as a pinned dependency.
• Tests/mocks — root __mocks__/react-native-keychain.js (auto-applied so all suites importing walletVault resolve it); extended src/__tests__/__mocks__/setup.ts MMKV mock (per-instance getAllKeys/clear/removeMMKV identity createJSONStorage); walletVault.test.ts extended with keychain + mock-MMKV migration coverage; useStellarWallet.test.tsx initializes the vault.

Acceptance criteria

• Wallet vault opens MMKV with a device-bound encryptionKey from the OS secure enclave.
• react-native-keychain added as a pinned dependency (iOS/Android).
• One-time migration runs on first launch after update; covered by a Jest unit test (mock keychain + mock MMKV).
• Plain-instance MMKV file deleted after successful migration.
• Existing walletVault.test.ts tests still pass with keychain mocked.
• No secret key value appears in console output, Zustand devtools, or persisted store snapshots.

Verification

• tsc --noEmit: clean
• eslint (changed files): 0 errors
• jest: 387/387 passing

Notes / out of scope

• Native linking (pod install / Gradle) is the platform build step; the dependency is added and consumed here.
• Biometric gate before key retrieval and changes to signChallengeXDR/buildPaymentXDR are intentionally out of scope.