Improve E2EE robustness and Android permissions

- Add IV validation and key sanitization for encryption
- Add stale key repair for media decryption failures
- Block READ_MEDIA_IMAGES/VIDEO permissions (use photo picker)
- Prevent double-tap crashes in media picker
- Clear media cache on logout
- Persist versionCode/buildNumber in app.json
- Bump Android targetSdk to 35

apps/mobile/src/store/authStore.ts

@@ -2,6 +2,7 @@ import { create } from "zustand";
 import { supabase } from "../lib/supabase";
 import { Events } from "../lib/analytics";
 import { clearKeys } from "../lib/encryption";
+import { clearDecryptedMediaCache } from "../hooks/useDecryptedMedia";
 import type { Profile, Couple } from "@/types";
 import type { RSAPublicKeyJWK, RSAPrivateKeyJWK } from "../lib/encryption/types";
 
@@ -181,6 +182,13 @@ export const useAuthStore = create<AuthState>((set, get) => ({
             console.error("Failed to clear encryption keys:", error);
         }
 
+        // Clear decrypted media cache to free storage
+        try {
+            await clearDecryptedMediaCache();
+        } catch (error) {
+            console.error("Failed to clear media cache:", error);
+        }
+
         // Clear local state FIRST to ensure UI updates even if Supabase call fails
         set({
             user: null,