App lock with system biometrics/PIN in Security settings

[kerdx]

Adds a new Security section in Settings with an app lock based on the system BiometricPrompt (fingerprint/face or phone PIN/pattern/password). No in-app PIN: auth is fully delegated to the OS.

• Toggle with confirmation auth on enable; error if the device has no screen lock
• User-chosen re-lock timeout after background (Immediately / 1 / 5 / 15 min); cold start always locks (fail-closed while prefs load)
• Optional FLAG_SECURE to hide the app preview in recents
• Lock gate above the NavHost in AppRoot (deep-links/share stay pending until unlock); MainActivity is now a FragmentActivity (BiometricPrompt requirement)

Tested: assembleDebug builds, installed on device.