Add optional app lock behind biometric or device credential

Implements a full app lock (issue #1313) gating Aurora Store behind the
device biometric or, where unavailable, the screen-lock credential
(PIN/pattern/password) so it also works on TVs and older phones.

- AppLockManager: process-scoped, in-memory lock state so a cold start is
  always locked, with a short background grace timeout to avoid
  re-prompting during the install dialog or the biometric sheet itself.
- AppLockAuthenticator: BiometricPrompt wrapper using
  BIOMETRIC_STRONG | DEVICE_CREDENTIAL on API 30+ and
  setDeviceCredentialAllowed on older releases, plus an enrollment check.
- ComposeActivity (now a FragmentActivity) gates content via a three-state
  machine (AUTHENTICATING/LOCKED/UNLOCKED); the authenticating state shows
  a blank surface behind the prompt so dismissing it never flashes the
  lock card. Re-locks on return past the timeout and sets FLAG_SECURE
  while locked.
- Toggle lives on a dedicated Security preference screen, reached from
  Settings like the other preference entries.

app/build.gradle.kts

@@ -196,6 +196,7 @@ dependencies {
     // AndroidX
     implementation(libs.androidx.core.ktx)
     implementation(libs.androidx.browser)
+    implementation(libs.androidx.biometric)
     implementation(libs.androidx.lifecycle.viewmodel.ktx)
     implementation(libs.androidx.lifecycle.navigation3)
     implementation(libs.androidx.preference.ktx)