fix(auth): enforce issuer + validate sign-in tokens + test the session guards

[heznpc]

Summary

Quality/security audit fixes for the Google auth flow in lib/auth-context.js + lib/env.js, with behavioral tests that fail if any bug is reintroduced.

Fixes

• [MAJOR/SECURITY] Issuer replay-bypass (isSessionStillValid): the issuer check was if (claims.iss && !ALLOWED_ISSUERS.has(claims.iss)) — a falsy/missing iss short-circuited the check, so a token minted with no issuer was honoured. Now if (!claims.iss || !ALLOWED_ISSUERS.has(claims.iss)) return false requires a present, allow-listed issuer.
• [MAJOR] {user:null} session persistence (handleAuthResult): a success with no decodable id_token used to write a {user:null} blob to SecureStore. Now it throws (caller maps to setError) and skips the write entirely.
• [MAJOR] Unified trust model (handleAuthResult): live sign-in now runs the same isSessionStillValid gate used on restore, so a session can no longer be "valid enough to log in but purged next launch". Expired / foreign-issuer tokens are rejected at sign-in.
• [TEST] assertGoogleEnv reachability (lib/env.js): env was read once at module load, making the missing-WEB-client throw untestable. Reads are now lazy + injectable (assertGoogleEnv(env), readGoogleClientIds(env)); on-device behaviour is unchanged because Expo still inlines EXPO_PUBLIC_*.
• [TEST] Coverage flakiness: the AuthProvider async lifecycle tests got explicit generous budgets (10s test / 4s waitFor) so jest --coverage is stable.

Tests

• Added isSessionStillValid unit tests: valid, expired exp, non-numeric exp, missing iss, empty iss, foreign iss, undecodable token.
• Added handleAuthResult guards: no-token / garbage-token / expired / foreign-issuer all throw and write nothing.
• Added assertGoogleEnv / readGoogleClientIds env tests (missing-WEB throw now reachable).
• Verified non-tautological by re-introducing each bug and confirming exactly the relevant tests go red, then reverting.

34/34 tests pass (was 20). Coverage: statements 88.23, branches 77.5, functions 83.33, lines 89.01 — all above thresholds (75/55/70/80). Lint clean. Coverage run stable across 5 consecutive runs.