feat(android): add structured entry editor and encrypted draft recovery (#103)

docs/android/entry-editor.md

@@ -0,0 +1,61 @@
+# Android entry editor
+
+Passwords offers New folder and New entry in configured stores, including an
+empty store. An unlocked entry offers Edit entry. The native form presents
+Rust field IDs, kinds, names, sensitivity, capabilities and generation options.
+Values are hidden until explicitly revealed. Named/repeated fields, multiline
+notes and OTP URIs can be added; accessible Up/Down and Remove controls obey
+Rust capabilities. Opaque non-UTF8 fields remain intact and cannot be edited.
+Generation requires confirmation before replacing the password.
+
+Rust owns validation, lossless entry serialization, recipients, generation,
+revision checks, atomic encryption/write and Git commits. Kotlin collects input
+and presents typed results. Failed validation and stale saves keep the draft;
+an explicit discard is required before Back, another tab or manual Lock can
+abandon dirty changes. Background/expiry clears plaintext presentation at once.
+
+The Rust authentication owner retains a ciphertext-only checkpoint in memory,
+including stable IDs, exact bytes and the original conflict base. Collected
+inputs are encrypted with monotonic versions; late completion cannot replace
+newer input. Unlock restores that draft without silently adopting a newer
+repository revision. The checkpoint is neither a repository format nor a disk
+draft. Save and confirmed discard remove it; process recreation removes all
+checkpoints and starts locked. SavedStateHandle contains only an editor-open
+boolean for the Rust-provided discarded-draft explanation, never fields or
+native editor handles.
+
+The existing protected Compose surface disables autofill/content capture,
+personalized IME learning and extraction. Activity/dialog secure flags protect
+screenshots; window focus loss and memory pressure clear protected presentation.
+Editor records redact their string representations. Long fields use a lazy
+scrolling form with IME padding, focus traversal and multiline input; keyboard
+activation and 200% text are exercised by instrumentation.
+
+Regression coverage uses public encrypted fixtures for folder/entry creation,
+dynamic repeated fields, PINs, multiline Unicode, OTP, add/remove/reorder,
+generation, atomic save, invalid input, stale conflict, explicit discard,
+background and two-second authentication expiry. A Rust fixture preserves an
+opaque non-UTF8 value through checkpoint recovery and a neighboring field edit.
+Compose tests cover typed callbacks, masking, keyboard save, confirmation,
+configured-empty creation and process-restart saved-state boundaries.
+
+Validation uses ARM64 emulators on API 26 (4 KB), API 37 (4 KB) and API 37
+(strict 16 KB), with app/core/bridge instrumentation and five cold starts on
+each. Debug/release builds, both ARM native ABIs, packaging, lint, architecture,
+dependency/license and SBOM gates accompany all four Rust workspace checks.
+ARMv7 is built and packaged; no live ARMv7 image was available. Physical devices
+and x86_64 are outside this milestone's support scope.
+
+Computer use in Android Studio's embedded emulator exercises a freshly created
+public fixture store: folder/entry creation, confirmed generation, dynamic PIN
+fields, save and reopening, dirty tab cancellation, background/expiry recovery
+and confirmed discard. The fixture uses a known public passphrase, with no user
+secret required. Editor entry clears viewer presentation without starting a
+competing storage refresh; completed mutations wait for directory refresh before
+accepting another operation. The core regression keeps the native process's
+single immutable private root throughout viewer and editor checks.
+
+The additive shared contract regenerates hardened Swift bindings. The iPhone
+and dependent watch simulator targets build after XcodeGen generation; the
+iPhone update preserves its app container, and computer use verifies locked
+folder navigation with existing data and biometric enrollment retained.