fix(security): persist lockout state across app relaunch

[EmeditWeb]

Summary

Closes #39

The security store held isLocked and failedAttempts in memory only, so killing and relaunching the app reset the failed-attempt count to zero — a user could bypass the 3-attempt lockout by relaunching between guesses. This persists both fields to SecureStore (localStorage on web), restores them on launch before the app renders, and clears them on sign-out. The attempt-count/lockout policy is extracted into a pure, unit-tested src/security/lockout.ts and reused by the biometric gate.

This repo is for the React Native mobile app only

• My changes are React Native components or Expo code
• I have NOT added web-only APIs (window, document, localStorage)
• I have NOT hardcoded hex color values (use constants/colors.ts only)
• All icons are from lucide-react-native only
• No API calls made directly in screen files (use services/ layer only)
• Every screen has loading, error, and empty states

Note: localStorage is used only inside the SecureStore adapter's Platform.OS === 'web' branch, mirroring the existing stores/auth.store.ts pattern — not in a screen or component.

Type of change

• Bug fix
• Service or store change

Testing

• npx expo export --platform web passes
• No TypeScript errors
• No hardcoded hex colors
• No console errors

New src/security/lockout.test.ts covers the count-up, threshold, past-threshold, and malformed-input cases. hydrate() is wired into app/_layout.tsx alongside the existing auth/user hydration and the render is gated on it so a locked session is never briefly shown unlocked; the auto-lock effect now waits for security hydration to avoid a rehydrate race. npm run typecheck, npm test, npm run lint, and npx expo export --platform web all pass.

Context files reviewed

• context/architecture-context.md
• context/code-standards.md