Auth and secure storage

Makes sign-in safe and complete on iOS and Android: tokens live only in the Keychain or Keystore behind one port, one session manager restores, refreshes and ends the session without races, route groups open and close with it, OAuth runs the code flow with PKCE, Sign in with Apple uses a nonce, and sign-out leaves nothing of the last person behind. A zero-dependency checker proves the structure; Jest tests prove the behaviour.

Rules that must hold