[R055LE]

Summary

• Add an opt-in encrypted password record per SSH identity, protected by its own authentication-bound Android Keystore AES-GCM key.
• Require Android 11+ and a secure device lock. Pass the exact cipher through the platform CryptoObject prompt for saves and each connection attempt; older or unsupported devices use manual entry.
• Add secure save/replace controls, confirmation-gated removal, and fail-closed manual recovery for cancellation, invalidation, and missing keys.
• Keep identity profiles and host trust intact when only the password is removed. Update the normative credential-security section in PROJECT_SPEC.md.
• Apply AES-GCM associated data after the CryptoObject is authenticated. The real device prompt exposed a Keystore rejection when it was applied earlier.

Closes #46.

Validation

• ./gradlew test lint assembleDebug :app:compileDebugAndroidTestKotlin passed after the fix.
• Focused API 35 connected tests passed, covering connection attempts, cancellation and manual fallback, invalidation recovery, replacement, removal, Room migration, and record preservation.
• Direct Keystore tests passed on an API 35 emulator with a temporary secure lock: 2 tests, 0 failures, 0 skips. Regression assertions require the authorization callback before cipher use.
• Manual platform check saved a disposable password through a real Android PIN prompt, then unlocked it through a separate prompt for a new connection attempt. The attempt then reached the expected SSH refusal from the emulator's loopback address. No external server was involved. The temporary emulator PIN was cleared afterward.