feat(auth): give Android a Keychain equivalent for the account list

[bmc08gt]

iOS keeps its account list in the Keychain, which is why deleting the app and reinstalling it still leaves the user a list to pick from. Android had no counterpart. Google Password Manager, which this replaces, could restore a single account but never enumerate them, and it sat behind a beta flag that was never used.

Block Store is the counterpart

Play services keeps the blob in its own directory rather than the app sandbox, so it outlives the app the way a Keychain item does. Three ways the equivalence is not exact, each of which the design leans on:

• It depends on Play services, and on Backup services being on. Writes are best effort as a result: losing the store costs an account its place in the list, not its funds — the access key is still the backstop. A mutation never rewrites a list it could not first read, so a failed read can drop an addition but cannot lose an existing entry.
• pm clear wipes it. Play services logs Removed Blockstore data for <pkg> upon clearing data. This outlives a reinstall, not a data clear.
• Cloud backup is conditional. It is requested only when Play services reports end-to-end encryption is available, which needs a screen lock, and the flag is recomputed on every write — leaving it unset deletes previously backed-up cloud data on the next sync.

What gets stored

The whole list lives in one of Block Store's 16 entries, packed by AccountRecordCodec as [version:1][count:2][record × count], each record 16 bytes of entropy plus three timestamps. That is 2003 bytes at the 50-account cap, roughly half the 4KB entry limit, which leaves room for a format change. Only the seed is stored; the owner key and the display name derive from it. AccountRecord mirrors iOS's AccountDescription, soft delete included.

Select an Account

Reachable the two ways iOS offers it: Log In routes there when the store holds accounts, and Advanced → Switch Accounts opens it from inside the app. Switch Accounts stays a StaffMenuItem, as it was behind the old flag, so it keeps both the beta/staff gate and the badge.

Balances are fetched per account with its own owner key as both the account owner and the requesting owner — a self-signed request, which is what makes them resolvable while logged out. A row the backend does not know says "Not Found"; a row whose balance could not be fetched says so separately. Collapsing the two would tell an offline user that every wallet they own is gone.

The in-app switcher hides the "Enter a Different Access Key" footer. From inside the app there is no onboarding flow to fall through to, and a logged-in user reaching for a new access key is logging out, which the menu already offers.

Credential Manager

Removed, along with FeatureFlag.CredentialManager. The existing credentials DataStore seeds Block Store on first launch, written as a condition rather than a one-shot upgrade hook so it also recovers an entry that decodes as empty. That DataStore is now excluded from Google backup.

Maestro flows

Three flows cover the list, the in-app switcher, and the case this whole change exists for. blockstore_survives_reinstall.yaml needs a real adb uninstall + install between flows, since Maestro has no uninstall command; its header gives the sequence. Switch Accounts is gated, so subflows/unlock_beta_features.yaml unlocks it the way a human does — seven taps on the version footer. The betaFlags launch argument only flips individual FeatureFlag keys and does not set that override.

Design and plan: docs/superpowers/specs/2026-09-18-blockstore-account-list-design.md and docs/superpowers/plans/2026-09-18-blockstore-account-list.md.