- Swift: getOrCreateKey(service:account:), loadKey(), deleteKey()
- Generates random AES-256 key, persists as hex in BLKeychain
- Subsequent calls return the same key for stable per-device DEK
- Kotlin: getOrCreateKey(store:account:), loadKey(), deleteKey()
- Generates random AES-256 key, persists as hex in BLSecureStore
- Uses EncryptedSharedPreferences for at-rest protection
- All existing tests still pass (21/21 Kotlin)
9bb322113a