#8 add app lock with passcode and biometric unlock

- Gate every layer behind AppLockView when the lock is enabled and
  lock on launch and on backgrounding; the passcode lives only in the
  Keychain (AppLockVault) and the enable state defaults to off.
- Add the lock section to Settings: enable/setup, change passcode and
  disable all require the current passcode via a shared passcode
  sheet; Face ID / Touch ID unlock prompts automatically and can be
  toggled with passcode confirmation.
- Add NSFaceIDUsageDescription to both app targets, cover the passcode
  policy with tests, guard the feature in verify.sh and document it in
  SECURITY.md.

Scripts/verify.sh

@@ -85,7 +85,11 @@ required=(
   Tests/SaslFailureMessageTests.swift
   Tests/MediaPreviewProcessorVideoTests.swift
   Tests/SCRAMSHA512Tests.swift
+  Tests/AppLockPolicyTests.swift
   Sources/Shared/XMPP/LumaScramSha512Mechanism.swift
+  Sources/Shared/Security/AppLockVault.swift
+  Sources/Shared/Models/AppLockPolicy.swift
+  Sources/Shared/UI/AppLockView.swift
   Sources/Shared/XMPP/SASLprep.swift
   Sources/Shared/XMPP/LumaSaslFailureModule.swift
   Sources/Shared/XMPP/SaslFailureMessage.swift
@@ -331,6 +335,22 @@ grep -q 'addMechanism(LumaScramSha512Mechanism' Sources/Shared/XMPP/XMPPService.
   echo "SCRAM-SHA-512 must be registered ahead of Martin's mechanisms"
   exit 1
 }
+grep -q 'NSFaceIDUsageDescription' project.yml || {
+  echo "Biometric unlock must declare its usage description"
+  exit 1
+}
+grep -q 'unlockWithBiometrics' Sources/Shared/Models/AppModel.swift || {
+  echo "The app lock must support biometric unlock"
+  exit 1
+}
+grep -q 'AppLockView' Sources/Shared/UI/RootView.swift || {
+  echo "The lock screen must cover every app layer"
+  exit 1
+}
+grep -q 'Блокировка приложения' Sources/Shared/UI/SettingsView.swift || {
+  echo "Settings must offer the app lock toggle"
+  exit 1
+}
 grep -q 'func deleteGroupChat' Sources/Shared/Models/AppModel.swift || {
   echo "Group chats must support local deletion"
   exit 1