fix: persist security store state to prevent lockout bypass

[EmeditWeb]

Problem

The security.store.ts (37 lines) stores isLocked, failedAttempts, and biometricCheckDone in memory only. After app restart: isLocked is false (app opens unlocked), failedAttempts is 0 (lockout bypassed), biometricCheckDone is false (biometric gate re-runs).

User impact: The auto-lock mechanism is defeated by restarting the app. Security features can be bypassed. After 3 failed biometric attempts → hard logout, but restarting the app resets the counter.

Root Cause

Persistence was not added to the security store because it was deemed "not needed for prototype."

What To Build

1. Add Zustand persist middleware to security.store.ts
2. Use SecureStore for storage (security-sensitive data)
3. Whitelist isLocked and failedAttempts
4. On sign-out: reset persisted security state
5. Add loading state during hydration

Files To Touch

• src/security/security.store.ts — add persist middleware with SecureStore

Acceptance Criteria

• isLocked survives app restart
• failedAttempts survives app restart
• Lockout cannot be bypassed by restarting
• Biometric check state persists
• Clean security state on sign-out

Mandatory Checks

• context/ files read
• npm test passes
• PR references this issue

[Samueltorres22]

I have experience with TypeScript/React state management and security-sensitive persistence patterns. For this fix I'd add Zustand persist middleware to security.store.ts using Expo SecureStore as the storage adapter, whitelisting only isLocked and failedAttempts (excluding biometricCheckDone from persistence since it should re-evaluate on each session). I'd add a isHydrating flag to block UI during rehydration, and wire store reset into the sign-out flow. Tests would cover: lockout survives restart, counter persists across sessions, and sign-out clears state cleanly.

[Iker2522]

I have extensive experience with React Native, Expo SecureStore, and Zustand persistence middleware. I reviewed src/security/security.store.ts and identified how memory reset bypasses the auto-lock feature. I will implement a custom SecureStore storage engine for the Zustand persist middleware, whitelist the critical security states (isLocked, failedAttempts), handle the hydration loading state, and submit a verified PR within 1 day.