feat(security): Add optional 15 and 30 minute auto-lock delays #60

User request

A user asked to extend Encly's configurable PIN/app auto-lock delay to 15 or 30 minutes for convenience. They understand that a shorter timeout may be an intentional security choice.

Original feedback (German):

Das einzige, was ich noch (für mich) ändern würde, dass man die App Pin Sperre noch etwas verlängern kann. Zb 15-30 min. Aber das ist wahrscheinlich mit Absicht bezüglich Sicherheit so gemacht.

Current behavior (code verified)

• app/src/main/java/com/pasich/encly/core/security/AutoLock.kt: AutoLockDelay currently supports Immediately, 15 seconds (default), 30 seconds, 1 minute, and 2 minutes.
• SessionLockManager allows background sessions to remain open for the configured delay, but screen-off or device lock ends the grace period immediately.
• Existing security design: #9.

Proposed change

• Add opt-in 15 minutes and 30 minutes options to the existing Settings → Security auto-lock delay control. Consider a 5-minute option if consistent with the UI, but it is not required for this request.
• Keep 15 seconds as the default, preserving current security behavior for existing installs.
• Show an unobtrusive explanation that longer delays mean the vault can remain decrypted while the app is backgrounded, increasing exposure if the device is left unattended.
• Preserve immediate lock on screen-off/device lock, independent of the selected timeout; do not modify the PIN derivation, lock screen, or encryption model.
• Reuse the existing AutoLockDelay persistence and SessionLockManager timer instead of introducing a separate lock policy.

Acceptance criteria

• 15-minute and 30-minute values can be selected and persist across app restarts.
• Defaults and existing stored selections remain unchanged.
• Resuming before the selected background timeout retains the current unlocked session as designed.
• Resuming after the timeout requires re-authentication and never briefly exposes decrypted notes.
• Screen-off and device-lock events still relock immediately, irrespective of configured delay.
• Lifecycle/timeout tests cover 15- and 30-minute options and edge cases (process death, resume at boundary, device lock).

Source

Direct user feedback via email. No implementation requested as part of filing this issue.