Brief description of what this PR changes and why.

• Bug fix
• New feature
• Security fix
• Refactor / tech debt
• Documentation
• Build / CI

Does this PR touch any of the following? If yes, describe the impact:

• Cryptographic primitives or parameters
• Key derivation or key management
• Authentication (PIN, biometric, decoy)
• Panic wipe or self-destruct
• Database schema or SQLCipher configuration
• Data storage or serialization

Security impact description: (fill in if any box above is checked)

• Tested on a real device
• Existing tests pass (./gradlew test)
• New tests added for changed logic

Device tested on: (model + Android version)

• No plaintext key material or note content in logs
• No new dependencies added without discussion
• PR targets main