#8 add app lock with passcode and biometric unlock

- Gate every layer behind AppLockView when the lock is enabled and
  lock on launch and on backgrounding; the passcode lives only in the
  Keychain (AppLockVault) and the enable state defaults to off.
- Add the lock section to Settings: enable/setup, change passcode and
  disable all require the current passcode via a shared passcode
  sheet; Face ID / Touch ID unlock prompts automatically and can be
  toggled with passcode confirmation.
- Add NSFaceIDUsageDescription to both app targets, cover the passcode
  policy with tests, guard the feature in verify.sh and document it in
  SECURITY.md.

Tests/AppLockPolicyTests.swift

@@ -0,0 +1,21 @@
+import XCTest
+@testable import Luma
+
+final class AppLockPolicyTests: XCTestCase {
+    func testMinimumLengthIsFour() {
+        XCTAssertEqual(AppLockPolicy.minimumLength, 4)
+    }
+
+    func testValidationRejectsShortPasscodes() {
+        XCTAssertFalse(AppLockPolicy.isValid(""))
+        XCTAssertFalse(AppLockPolicy.isValid("1"))
+        XCTAssertFalse(AppLockPolicy.isValid("123"))
+    }
+
+    func testValidationAcceptsFourOrMoreCharacters() {
+        XCTAssertTrue(AppLockPolicy.isValid("1234"))
+        XCTAssertTrue(AppLockPolicy.isValid("пароль"))
+        XCTAssertTrue(AppLockPolicy.isValid("long-passcode"))
+    }
+}
+