authenticateForEncrypt
Authenticates the user and returns a cipher ready for encryption.
The cipher has a Keystore-generated random IV accessible via Cipher.getIV. After calling Cipher.doFinal, store the result as: [IV (12 bytes)] + [ciphertext + GCM auth tag (16 bytes)]
Exception propagation: android.security.keystore.KeyPermanentlyInvalidatedException is thrown synchronously from WalletKeyManager.cipherForEncrypt BEFORE the biometric prompt is shown. The caller should catch it at the call site and trigger the key-recreation recovery flow.
Parameters
The FragmentActivity hosting the biometric prompt
Prompt title shown to the user
Optional subtitle (e.g., "Encrypt wallet seed")
Throws
if the user cancelled
if the device is temporarily locked out
if permanently locked out
for all other failures