[PM-42871] [Xperia 1 VII / Android 16] Successful fingerprint authentication fails Keystore authorization and disables biometric unlock

### Steps To Reproduce

1. On a Sony Xperia 1 VII, enable **Unlock with biometrics** in Bitwarden.
2. Allow the vault to lock, or request autofill while the vault is locked.
3. Start the fingerprint authentication prompt.
4. Place a registered finger on the phone's side-mounted fingerprint sensor.
5. Repeat the authentication process until the fingerprint sensor responds unusually slowly. When this happens, recognition and vibration take approximately one second.
6. The finger can sometimes be removed from the sensor before the delayed success indication appears.
7. Android's native biometric UI reports successful authentication, but Bitwarden subsequently reports that biometric unlock failed.

### Expected Result

When Android's biometric prompt reports successful fingerprint authentication, the authenticated Keystore cipher should be authorized and Bitwarden should unlock the vault.

If Android fails to authorize the cryptographic operation despite reporting biometric success, Bitwarden should treat that attempt as transient, preserve the existing biometric configuration, and allow the user to retry.

### Actual Result

Android's native biometric UI reports successful fingerprint authentication, including the success indication and vibration.

Immediately afterward, Bitwarden reports that biometric unlock failed and says that biometric authentication must be enabled again. The “Unlock with biometrics” setting is then disabled.

The Flight Recorder shows that Bitwarden's cipher operation failed because Android Keystore had not received an authentication token, despite the native biometric success:

javax.crypto.IllegalBlockSizeException
Caused by: android.security.KeyStoreException: Key user not authenticated
No operation auth token received.
Error::Km(KEY_USER_NOT_AUTHENTICATED)
public error code: 2

### Screenshots or Videos

_No response_

### Additional Context

This problem is intermittent. Biometric unlock normally works, but it is more likely to fail when the fingerprint sensor takes approximately one second to respond. In the failure case, I can sometimes remove my finger before the sensor eventually vibrates and Android displays the successful authentication state.

The same stored biometric key successfully unlocked the vault numerous times earlier in the same Flight Recorder session. This means that the saved key and ciphertext were not permanently corrupt.

Immediately after the native biometric success, the Flight Recorder captured:

unlockVaultWithBiometrics failed when decrypting biometrics key

javax.crypto.IllegalBlockSizeException
at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(...)
at javax.crypto.Cipher.doFinal(...)

Caused by: android.security.KeyStoreException:
Key user not authenticated
internal Keystore code: -26

Caused by:
Trying to get auth tokens for uid 10363
In AuthInfo::get_auth_tokens.
No operation auth token received.
Error::Km(KEY_USER_NOT_AUTHENTICATED)
public error code: 2
internal Keystore code: -26

This appears to indicate that the Xperia/Android biometric stack reported a successful fingerprint match but did not attach the corresponding authentication token to Bitwarden's pending Keystore operation.

Bitwarden correctly refuses to decrypt the vault key without Keystore authorization. However, it currently catches the resulting `GeneralSecurityException` as a `BiometricDecodingError` and immediately clears the user's biometric configuration. In this case, the underlying Keystore error is `ERROR_USER_AUTHENTICATION_REQUIRED`, rather than evidence of a permanently corrupt or invalidated key.

A safer recovery behaviour may be to inspect the exception cause chain. If it contains an `android.security.KeyStoreException` with numeric error code `ERROR_USER_AUTHENTICATION_REQUIRED`, Bitwarden could preserve the biometric key and configuration, then allow or request another biometric attempt using a fresh cipher. Permanent key-invalidity and genuine decoding errors could continue to clear the configuration.

Possibly related existing issue: https://github.com/bitwarden/android/issues/6550

I can provide the complete Flight Recorder to the Bitwarden team through a non-public channel if additional diagnostics are required.

### Build Version

2026.8.0 (21819)

### What server are you connecting to?

US

### Self-host Server Version

_No response_

### Environment Details

- Device: Sony Xperia 1 VII (XQ-FS44)
- OS Version: Android 16 (API 36)
- Device firmware/build: 71.1.A.2.210
- Bitwarden build: release/standard
- Bitwarden CI commit: 8be53c1ae519ab417b64b0d2154f9815adf7c44a
- Bitwarden SDK: 3.0.0-8157-eb825d59
- Server: Bitwarden Cloud, US region
- Server version recorded by Flight Recorder: 2026.8.0
- Reproduction frequency: Intermittent
- Biometric hardware: Side-mounted fingerprint sensor

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Start by locating unlockVaultWithBiometrics and the BiometricDecodingError handling, then trace the GeneralSecurityException cause chain around the Android Keystore cipher operation. Reproduce the Xperia failure if possible and verify that ERROR_USER_AUTHENTICATION_REQUIRED preserves biometric configuration and permits retry, while permanent invalidity still clears it.

Written by the indexing model from the issue text.