tryDecryptWithinAuthWindow

Attempts to decrypt ciphertext with the master key WITHOUT showing a BiometricPrompt. Succeeds silently when the Keystore auth-validity window (set via AuthPolicy.VALIDITY_DURATION_SECONDS) is currently open for the key. The caller MUST wipe the returned bytes once it's done with the plaintext.

Returns null when the window is expired (android.security.keystore.UserNotAuthenticatedException from the Cipher) or any other exception is hit. The caller should fall back to the full authenticateForDecrypt path in that case.

Why this is safe: UserNotAuthenticatedException is enforced in secure hardware by Keystore — we cannot bypass the auth requirement from app code. If the user authenticated recently enough for the window to count, the decrypt is exactly equivalent to the next decrypt after a fresh BiometricPrompt; if not, the cipher refuses to operate and we get null.