Biometric unlock on macOS (Touch ID)

[zanni098]

Summary

Biometric unlock is implemented for Windows Hello (src/biometric.rs). macOS support is currently a stub that returns an error.

Proposal

Implement Touch ID support on macOS using the LocalAuthentication framework via the objc or core-foundation crates.

Tasks

• Add macOS-specific biometric verification using LocalAuthentication (LAContext)
• Use macOS Keychain (SecItemAdd/SecItemCopyMatching) to store the biometric key securely
• Implement dpapi_encrypt / dpapi_decrypt equivalents for macOS (Keychain instead of DPAPI)
• Update verify_biometric for #[cfg(target_os = "macos")]
• Test on macOS with a real Touch ID device
• Update UI copy in VaultUnlock.tsx to say "Touch ID" on macOS

Context

• Current implementation: apps/desktop/src-tauri/src/biometric.rs
• Windows uses windows::Security::Credentials::UI::UserConsentVerifier + DPAPI
• macOS stub at line 52 returns HemdalError::BiometricError("Touch ID support is not yet implemented")
• The frontend already supports biometric unlock via unlock_with_biometric command

Acceptance Criteria

• macOS users can enable Touch ID unlock from the vault dashboard
• After locking, the unlock screen shows "Unlock with Touch ID"
• Touch ID verification successfully unlocks the vault
• The biometric key is stored in the macOS Keychain, not plaintext