Phase 7H production hardening.

Shipped: Tightened Firestore rules with strict deny-all defaults. Encrypted SQLite at rest on Android and iOS via SQLCipher 4.x with per-device keys. Cross-platform secure storage layer on top of Flutter Secure Storage.