new feature: long press OTP card in OTP codes page to export or update seed

app/src/main/java/sh/sar/basedbank/util/CredentialStore.kt

@@ -100,6 +100,11 @@ class CredentialStore(context: Context) {
             .apply()
     }
 
+    /** Replaces only the stored TOTP seed; the old seed is overwritten and cannot be recovered. */
+    fun updateMibOtpSeed(loginId: String, otpSeed: String) {
+        prefs.edit().putString("mib_${loginId}_enc_otp_seed", encrypt(otpSeed, getOrCreateKey())).apply()
+    }
+
     fun loadMibCredentials(loginId: String): MibCredentials? {
         val key = getOrCreateKey()
         val encHash = prefs.getString("mib_${loginId}_enc_password_hash", null) ?: return null
@@ -230,6 +235,11 @@ class CredentialStore(context: Context) {
             .apply()
     }
 
+    /** Replaces only the stored TOTP seed; the old seed is overwritten and cannot be recovered. */
+    fun updateBmlOtpSeed(loginId: String, otpSeed: String) {
+        prefs.edit().putString("bml_${loginId}_enc_otp_seed", encrypt(otpSeed, getOrCreateKey())).apply()
+    }
+
     fun loadBmlCredentials(loginId: String): BmlCredentials? {
         val key = getOrCreateKey()
         val encUsername = prefs.getString("bml_${loginId}_enc_username", null) ?: return null

app/src/main/java/sh/sar/basedbank/util/OtpauthParser.kt

@@ -13,6 +13,27 @@ object OtpauthParser {
         else -> emptyList()
     }
 
+    /**
+     * Normalise user input into a bare Base32 secret: accepts an otpauth:// link or a raw
+     * secret with spaces/dashes. Returns null if the result isn't usable as a TOTP seed.
+     */
+    fun resolveSecret(input: String): String? {
+        val raw = input.trim()
+        val secret = if (raw.startsWith("otpauth://")) Uri.parse(raw).getQueryParameter("secret") ?: return null else raw
+        val clean = secret.replace("\\s".toRegex(), "").replace("-", "").trimEnd('=').uppercase()
+        if (clean.isEmpty() || !clean.all { it in 'A'..'Z' || it in '2'..'7' }) return null
+        // Too short to be a real seed, e.g. a pasted 6-digit OTP code
+        if (clean.length < 8) return null
+        return clean
+    }
+
+    /**
+     * Build the shortest otpauth://totp link authenticator apps accept: just a label and the
+     * secret. SHA1, 6 digits and a 30s period are the spec defaults, so they're left out.
+     */
+    fun buildUri(label: String, secret: String): String =
+        "otpauth://totp/" + Uri.encode(label) + "?secret=$secret"
+
     private fun parseStandard(raw: String): OtpEntry? {
         val uri = Uri.parse(raw)
         val secret = uri.getQueryParameter("secret") ?: return null