[P1] DataStore session storage with encrypted tokens

[amaury901130]

security-crypto (EncryptedSharedPreferences) is deprecated. Store session in DataStore; encrypt tokens with Tink/Android Keystore. Include migration from old prefs if needed for existing apps.

Acceptance criteria

• Session persisted in DataStore
• Tokens encrypted at rest

Reference: Android Base — Modernization Audit & Recommendations — section: Findings > Security