security: encrypt credentials, caches, and harden lock screen

app/src/main/java/sh/sar/basedbank/api/bml/BmlLoginFlow.kt

@@ -69,8 +69,11 @@ class BmlLoginFlow {
         val xsrf = xsrfToken() ?: throw Exception("Could not fetch login page")
 
         // Step 2: POST credentials
-        val loginBody = """{"username":${quote(username)},"password":${quote(password)},"code":""}"""
-            .toRequestBody("application/json".toMediaType())
+        val loginBody = JSONObject().apply {
+            put("username", username)
+            put("password", password)
+            put("code", "")
+        }.toString().toRequestBody("application/json".toMediaType())
         val loginResp = client.newCall(
             Request.Builder().url("$BASE_URL/web/login").post(loginBody)
                 .header("X-XSRF-TOKEN", xsrf)
@@ -89,8 +92,10 @@ class BmlLoginFlow {
 
         // Step 4: POST OTP
         val otp = Totp.generate(otpSeed)
-        val twoFaBody = """{"code":${quote(otp)},"channel":"authenticator"}"""
-            .toRequestBody("application/json".toMediaType())
+        val twoFaBody = JSONObject().apply {
+            put("code", otp)
+            put("channel", "authenticator")
+        }.toString().toRequestBody("application/json".toMediaType())
         val twoFaResp = client.newCall(
             Request.Builder().url("$BASE_URL/web/login/2fa").post(twoFaBody)
                 .header("X-XSRF-TOKEN", xsrf2)
@@ -740,6 +745,4 @@ class BmlLoginFlow {
         SecureRandom().nextBytes(bytes)
         return bytes.joinToString("") { "%02x".format(it) }
     }
-
-    private fun quote(s: String) = "\"${s.replace("\\", "\\\\").replace("\"", "\\\"")}\""
 }