Encrypt HybridFileBackedSqlStorage with Android Keystore

[avazirna]

Product Description

No user-facing changes. This is an internal security enhancement that extends Android Keystore encryption to the HybridFileBackedSqlStorage layer, which stores fixtures and other file-backed data.

Technical Summary

Extends the Keystore encryption work from encrypt-form-submissions-with-keystore to cover HybridFileBackedSqlStorage. New records are encrypted using the Android Keystore key (via CommCareKeyManager), while existing records encrypted with legacy per-record AES keys continue to be readable.

Key changes:

• HybridFileBackedSqlStorage: branch read/write/output-stream paths for Keystore vs legacy encryption based on whether the stored AES key is empty
• CommCareKeyManager: add @VisibleForTesting test override for session key to enable unit testing without a real Keystore
• EncryptionIO: remove unused SecretKeySpec import
• FormUploadUtil: remove dead getDecryptCipher methods (cipher creation now centralized in EncryptionIO)
• Add HybridFileBackedSqlStorageKeystoreTest with round-trip write/read, new record write, and filesystem-to-DB migration tests
• Pass Keystore encryption flag to performance tracing

Feature Flag

Gated by AndroidKeyStore.isKeystoreAvailable() — only activates on devices with hardware-backed Keystore support.

Safety Assurance

Safety story

• Backward compatible: existing records with non-empty AES keys continue to use the legacy decryption path
• The empty-key sentinel (aesKeyBytes == null || aesKeyBytes.length == 0) cleanly distinguishes Keystore-encrypted records from legacy ones without schema changes
• Tested locally with Robolectric unit tests using a mock Keystore provider

Automated test coverage

• HybridFileBackedSqlStorageKeystoreTest: 3 tests covering Keystore-encrypted write+read, new record creation, and filesystem↔DB migration round-trips

QA Plan

• Install on a device with Keystore support, log in, and verify fixtures load correctly
• Verify that previously saved data (legacy encrypted) is still readable after the update
• Monitor TRACE_FILE_ENCRYPTION_TIME traces for Keystore vs legacy performance

Labels and Review

• Do we need to enhance the manual QA test coverage ? If yes, the "QA Note" label is set correctly
• Does the PR introduce any major changes worth communicating ? If yes, the "Release Note" label is set and a "Release Note" is specified in PR description.
• Risk label is set correctly
• The set of people pinged as reviewers is appropriate for the level of risk of the change