Yanami Next v0.1.0: final hardening and release readiness

[ciallothu]

Summary

• rebuild Android/iPhone terminal retry, scrolling/input, generation isolation, and Komari sensitive-operation 2FA
• add cryptographic App Lock (Android Keystore CryptoObject; iPhone AES-256-GCM with biometric Keychain ACL)
• correct node presence, IP masking/search, realtime Traffic versus cumulative Traffic Usage, timestamp and connection semantics
• prevent stale authentication, cross-server token reuse, cancelled form commits, widget/background credential access, and credential-bearing network logs
• improve chart empty/error handling, localization, narrow-screen layout, and terminal accessibility
• keep app/release metadata aligned at Yanami Next v0.1.0 (build 10000)

Local verification

• Android testDebugUnitTest: 69 tests, 0 failures
• Android lintRelease: passed
• Android signed assembleRelease: universal, arm64-v8a, armeabi-v7a passed
• all APKs: v2 signature verified, expected SHA-256 certificate fingerprint, version 0.1.0 / 10000
• iPhone NodeMetricsPolicyTests and SecurityLifecyclePolicyTests: passed with Swift 6.1
• all iPhone Swift sources: parser clean
• Actionlint 1.7.12: passed
• Gitleaks 8.30.1: current source and 120-commit history, no leaks
• Android/iPhone en, zh-Hans, ja localization key parity: passed

Security notes

• one-time 2FA codes are neither persisted nor logged and cannot be reused by automatic reconnects
• authentication/session writes require the complete current server identity
• iPhone protected-state transitions are fail-closed at every durable crash boundary
• distributable Ktor request/response logging is disabled because custom headers may contain arbitrary credentials

Please require both Test & Build and Security Audit workflows to pass before merge.