Hash app lock secrets

[zerox80]

What changed

• Store PIN and pattern lock values as salted PBKDF2 hashes instead of plain text.
• Migrate old plain text values after a successful unlock.
• Stop logging the actual pattern while the user draws it.

Why

The app lock should not leave the PIN or pattern readable in preferences or logs. Existing users can still unlock once with the old value, then it gets upgraded.

Checks

• git diff --check
• Targeted rg scans for plain text app-lock storage and pattern value logs
• Gradle tests not run locally because JAVA_HOME is not set and java is not on PATH