feat(mobile): protect sensitive identity transfers

[tellaho]

Category: new-feature
User Impact: Mobile users can require Face ID, biometrics, or their device passcode before Buzz sends their identity to a desktop.

Problem: SAS verification confirms that both pairing devices share the same encrypted session, but a phone holding an identity could still release it without fresh local user verification. Existing identities also had no per-identity control for requiring that additional ceremony.

Solution: Add an OS-backed sensitive-action authorizer and persisted per-identity policy, gate protected mobile-to-desktop recovery before payload construction, and expose checked-by-default onboarding plus Mobile security controls. Routine signing and startup remain prompt-free, while protected exports fail closed on cancellation, lockout, failure, or unavailable device authentication.

File changes

mobile/pubspec.yaml / mobile/pubspec.lock
Add local_auth for OS biometric and device-credential prompts.

mobile/android/app/src/main/kotlin/xyz/block/buzz/mobile/MainActivity.kt
Use FlutterFragmentActivity, as required by Android biometric prompts.

mobile/ios/Runner/Info.plist
Explain why Buzz requests Face ID access.

mobile/lib/shared/security/sensitive_action_authorizer.dart
Centralize OS authentication and map platform failures into coarse control-flow outcomes.

mobile/lib/shared/community/community.dart
Persist notConfigured, enabled, or disabledByUser independently for each identity, with legacy records migrating to notConfigured.

mobile/lib/shared/auth/auth_provider.dart
Persist policy changes for the active identity and refresh dependent providers.

mobile/lib/features/pairing/pairing_provider.dart
Require successful OS authentication before protected recovery payload construction, keep unprotected recovery on the existing SAS path, and persist the onboarding choice for imported identities.

mobile/lib/features/pairing/pairing_page.dart
Add checked-by-default import protection copy and surface authorization failures without treating cancellation as opt-out.

mobile/lib/features/settings/settings_page.dart / mobile/lib/features/settings/settings_page/mobile_security_section.dart
Add per-identity Mobile security controls and live device-authentication availability.

mobile/test/features/pairing/pairing_provider_test.dart
Cover protected success, cancellation, and the no-payload-before-auth invariant.

mobile/test/features/pairing/pairing_page_test.dart
Cover checked-by-default import UI and its exclusion from desktop recovery UI.

mobile/test/shared/community/community_test.dart
Cover legacy policy migration and serialization round trips.

Reproduction steps

1. Pair a desktop identity into mobile and reach SAS confirmation.
2. Verify the sensitive-action protection checkbox is checked by default, and that unchecking it allows the ordinary SAS import path.
3. Leave it checked, confirm SAS, and verify the OS asks for biometrics or the device passcode before import completes.
4. Open Settings → Mobile security and toggle sensitive-action confirmation for the active identity.
5. Start “Send identity to desktop” for a protected identity, confirm SAS, and verify cancellation or failed OS authentication sends no identity payload.
6. Complete OS authentication and verify the desktop receives the identity only afterward.

Validation

• cd mobile && flutter analyze
• cd mobile && flutter test (1,254 tests)
• Pre-push hooks: mobile, desktop, Rust, and Tauri checks passed

Screenshots / demos

Not included: the final states depend on a real mobile OS authentication sheet and should be captured during device validation rather than mocked.

Stack

Draft stacked on #4845 (bd74b7d467d42e3dde4b2a26c9103e2797c44488).

[tellaho]

Closing at the operator’s request. This pull request was opened prematurely without explicit authorization.