Implement Vault module internals (seed generation, encryption at rest, gated decryption)

[mocolicious]

Build the core Vault module:

• Generate root seed and securely store using Android Keystore (AES-GCM with StrongBox if available).
• Enforce encryption at rest; never expose plaintext seeds.
• Require biometric or device credential authentication for decryption, using Jetpack BiometricPrompt.