chore(audit): inline TODO for corrupt-blob purge

Minor finding from the 2026-05-21 second-pass: lib/auth-context.js:165
swallows a SecureStore JSON.parse failure without deleting the blob.
Self-healing on next successful sign-in (setItemAsync overwrites), but
the explicit-purge is cheap and the silent-swallow is the kind of thing
that hides the next bug. Filed as inline TODO per audit policy — no
separate PR.

Author: heznpc

lib/auth-context.js

@@ -164,6 +164,9 @@ export function AuthProvider({ children }) {
         }
       } catch {
         // corrupt blob -> treat as signed out
+        // TODO(2nd-pass-audit-2026-05-21): also call deleteItemAsync here
+        // so a corrupt blob is purged rather than re-read on every mount.
+        // Self-healing on next successful sign-in, but explicit is better.
       } finally {
         if (!cancelled) setLoading(false);
       }