Implement Rust-owned Android Keystore secure storage (#93)

docs/android/private-storage.md

@@ -17,7 +17,7 @@ activation fail instead of consulting HOME, cwd, XDG or public storage.
 | version / device binding | `noBackupFilesDir/ironstorage/layout.toml` | Atomic version 1 marker; unknown versions require a compatible migration |
 | transactional scratch | `noBackupFilesDir/ironstorage/scratch` | Per-owner file locks; startup removes orphaned transactions and skips live owners |
 | disposable cache | `cacheDir/ironstorage` | Only this capability is cleared by `clearDisposableCache`; vault/key/catalog data is retained |
-| protected binding and credentials | OS secure backend / no-backup ciphertext (#93) | No serialized token or passphrase in configuration or layout metadata |
+| protected binding and credentials | Keystore AES-GCM keys / `noBackupFilesDir/ironstorage/secrets` (#93) | No serialized token or passphrase in configuration or layout metadata |
 | `filesDir` | OS root fact only | No durable password-store object is placed here |
 
 Directory opens use safe Rust `rustix` handles with `NOFOLLOW`; names are single
@@ -45,9 +45,9 @@ links without following their targets and cannot descend into the vault.
 persists only its SHA-256 in layout metadata. A missing or mismatched protected
 record for an already bound layout reports `RestoredWithoutKeystore` or
 `InvalidSecureBinding`; it never creates a replacement that would conceal key
-loss. Locked/unavailable storage has separate recovery kinds. #93 supplies the
-real Android Keystore adapter; the contract already executes through the
-injected backend and is tested with loss/mismatch fixtures.
+loss. Locked/unavailable storage has separate recovery kinds. #93 supplies the [real Android Keystore adapter](keystore.md); startup verifies
+the binding through it before presenting the shell. The contract is tested with
+loss/mismatch fixtures.
 
 Errors distinguish full storage, read-only storage, access denial, missing
 roots, concurrent initialization, corrupt configuration/layout and unsupported