feat(vault): vault storage (user-isolated, multi-account)

src/config/index.ts

@@ -64,20 +64,39 @@ export const API_ENDPOINTS = {
   },
 } as const;
 
-/**
- * Vault storage key names (AsyncStorage keys only — not user-editable "initial values").
- * - These are constants: the key names used to read/write/remove vault state in AsyncStorage.
- * - The actual stored values (S0 data, '1') are set by the app; do not change these key strings
- *   unless you are migrating storage (changing them would make existing data unfindable).
- * - Placed in config so VaultScreen and MeScreen (and others) use the same keys in one place.
- * - INITIALIZED: app sets to '1' after first mnemonic flow; SHARE_DEVICE: app stores serialized S0.
- * - "Reset Vault State" = remove both keys; next vault open sees no S0 and shows mnemonic flow.
- */
+// =============================================================================
+// Vault storage (user-isolated, multi-account)
+// =============================================================================
+// - AsyncStorage keys for vault state (S0 share, initialized flag).
+// - User-scoped: each account has its own keys so vault state is isolated.
+// - Store: use getVaultStorageKeys(userId) and write to INITIALIZED / SHARE_DEVICE.
+// - Clear: use same keys in multiRemove (e.g. MeScreen Reset Vault State).
+// - Multi-account: same device, multiple users → each has independent vault (no cross-user leakage).
+
+const VAULT_KEY_PREFIX = 'sentinel_vault';
+
+/** Base key names (for reference). Prefer getVaultStorageKeys(userId) for all reads/writes. */
 export const VAULT_STORAGE_KEYS = {
   INITIALIZED: 'sentinel_vault_initialized',
   SHARE_DEVICE: 'sentinel_vault_s0',
 } as const;
 
+/**
+ * Returns vault storage keys for the given user (user isolation).
+ * - Use for: reading S0, writing S0 after mnemonic, clearing on Reset Vault State.
+ * - userId null → guest namespace (_guest). userId set → per-user namespace (_u{userId}).
+ */
+export function getVaultStorageKeys(userId: number | string | null): {
+  INITIALIZED: string;
+  SHARE_DEVICE: string;
+} {
+  const suffix = userId != null ? `_u${userId}` : '_guest';
+  return {
+    INITIALIZED: `${VAULT_KEY_PREFIX}_initialized${suffix}`,
+    SHARE_DEVICE: `${VAULT_KEY_PREFIX}_s0${suffix}`,
+  };
+}
+
 // =============================================================================
 // Helper Functions
 // =============================================================================