Store authentication tokens in platform-secure storage

[koniz-dev]

Context

authService writes AUTH_TOKEN through the general-purpose AsyncStorage wrapper. AsyncStorage is not an appropriate protected store for bearer tokens on native devices; the starter should demonstrate a secure default.

Acceptance criteria

1. On iOS and Android, login tokens are stored, read, and deleted through a platform-secure mechanism (for example Expo SecureStore), not AsyncStorage.
2. Non-sensitive values, including user profile/cache data, may remain in the existing AsyncStorage wrapper.
3. The implementation defines and tests behavior when secure storage is unavailable or fails, without treating the user as authenticated.
4. Documentation distinguishes secure credential storage from general application storage and gives an accurate web-platform caveat.
5. npm run lint, npm run type-check, and npm run test:ci pass.

[koniz-dev]

Automated criteria PASS; native storage verification remains human-only.

1. Tokens are stored, read, and deleted through Expo SecureStore; user data remains in AsyncStorage. Evidence: docs/evidence/issue-11/03-test-ci.log.
2. Unavailable protected storage rejects login before token or user data is persisted. Evidence: docs/evidence/issue-11/03-test-ci.log.
3. Documentation distinguishes protected credentials, AsyncStorage data, and the web limitation. Evidence: docs/evidence/issue-11/summary.md.
4. Lint, type-check, Jest, and format checks pass. Evidence: docs/evidence/issue-11/01-lint.log, docs/evidence/issue-11/02-type-check.log, docs/evidence/issue-11/03-test-ci.log, docs/evidence/issue-11/04-format-check.log.

Human UAT required on both iOS and Android: (a) launch the app, open the authentication demo, and sign in; (b) background/terminate and relaunch, then confirm the token remains readable through authService.isAuthenticated(); (c) log out and relaunch, then confirm the session is absent; (d) inspect device secure-storage tooling as appropriate to confirm auth_token is in Keychain/Keystore rather than AsyncStorage. Commit: 21a1bd6