MuSig: device security

**Goal:** protect a Connect app that can now direct funds. The device holds no keys, but the pairing credential carries spend authority - a stolen or compromised phone can command the node's wallet.

**Scope**

- Biometric / PIN app lock (unlock app + gate spend-capable actions)
- Hide balances (privacy mode; mask in app-switcher / background)
- Screenshot & screen-recording protection (`FLAG_SECURE` / iOS equivalent) --> Already implement, reuse Security composable in the right screens
- Transaction confirmation UX (verify amount + address before authorizing the node to sign)
- Pairing-credential protection + revocation (lost device ⇒ revoke from the node; ties into the paired-devices/revoke work in connect-node-operator-experience)
- Rooted / jailbroken-device posture

**TODO**: Split into sub-issues as per scope above, probably some of them we can start implementing as part of the security hardening to avoid arriving next year with all pending.