Harden vault workflows and professionalize GitHub presentation

[TheStreamCode]

Summary

• make PIN setup/change and KDF metadata updates transactional, with fail-closed authentication cleanup on uncertain storage
• import backups through bounded validation and atomic batched storage mutations
• harden crypto, permissions, dependency auditing, frozen CI installs, and Dependabot configuration
• reposition the public README around the Android product, Google Play availability, security model, and production screenshots
• improve contributor guidance, issue intake, publication documentation, and the dated security audit

Security and compatibility

• preserves the KS1 and KS1-PW1 payload formats, storage keys, and existing vault KDF parameters
• keeps biometric key lifecycle and active-key guards covered by tests
• does not add remote vault transport or Android media permissions
• documents accepted cryptographic compatibility trade-offs instead of changing formats in place

Validation

• bun install --frozen-lockfile
• bun run verify — 30 suites, 212 tests, Expo Doctor 20/20
• bun audit --audit-level=critical — no critical advisories
• Prettier check and git diff --check
• Android export and generated-native release checks were completed during the audit

No EAS build, submission, tag, release, or deployment was started.