Use Android Keystore for device auth storage

[0xh3rman]

Summary

• Store new device-auth keys with direct Android Keystore AEAD and a dedicated alias.
• Lazily migrate readable values from the legacy Tink keyset-backed store.
• Reset only the regenerable device-auth values when the direct Keystore key is missing or cannot authenticate the ciphertext.
• Keep the password and Gem preference stores unchanged.

Root cause

The exact originating Keystore condition is unknown. The crash happens when AndroidKeysetManager cannot authenticate its SharedPreferences-wrapped Tink keyset with the Android Keystore master key, which raises BadPaddingException or AEADBadTagException.

GetDeviceIdImpl catches the failed read and generates a new device key pair, but the old implementation then writes through the same unreadable Tink keyset and crashes again. New device-auth writes now use Android Keystore AEAD directly, so regeneration no longer depends on that legacy keyset. Existing readable values migrate on first read.

Impact

Fixes the two observed device-auth crash paths. Invalid direct-Keystore data is cleared so the device identity can be regenerated; unrelated Android Keystore failures may still surface.

Validation

• ./gradlew :app:assembleGoogleDebug
• ./gradlew :app:lintGoogleDebug
• 8 TinkEncryptedKeyValueStoreInstrumentedTest tests on API 35
• git diff --check

[0xh3rman]

Verified the migration and self-heal end-to-end on an emulator upgrading from 2.114.6 (old-format values), which surfaced a bug — fixed in 64e643a:

Bug: after resetOnInvalidKey rotates the device keypair, the device could never re-register. getOrCreateDevice short-circuited on the stale local DeviceRegistered flag and called getDevice(), which throws GemApiException: Device not found for the rotated id (GemApiErrorInterceptor converts the error body) instead of returning null — so the registerDevice fallback was unreachable. The WebSocket looped Device not found across app restarts, permanently. Fix: consult backend isDeviceRegistered() instead of the local flag.

Verification (Pixel 10 Pro AVD, API 37):

• Migration: both gem_device_keys values rewritten in place to android-keystore-v1: format, no error logs, device id unchanged, second launch idempotent (byte-identical ciphertexts)
• Self-heal: corrupted both stored values → no crash, corrupt entries dropped, keypair regenerated; with the fix the rotated device re-registers (pushed device id updated, subscriptions reconciled, zero WS errors)

Note: :data:repositories unit tests currently don't compile on this branch (AssetsRepositoryTest.kt out of sync with AssetsRepository, 14 errors, pre-existing).