feat(storage): add keyed secret fingerprints to record headers

An 8-byte HMAC of kind, type and secret (key derived from the device key)
in header tag 13 lets imports find duplicates of locked entries while the
watch is locked. Vault gains anyHeader() and storage().

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/source/storage/Entry.mc b/source/storage/Entry.mc
index 57e0309..23c95c0 100644
--- a/source/storage/Entry.mc
+++ b/source/storage/Entry.mc
@@ -52,6 +52,9 @@ class Entry {
     var counter as Long = 0l;
     var created as Long = 0l;
     var namesEncrypted as Boolean = false;
+    // Keyed fingerprint of the type and secret (or payload), set by the
+    // vault: finds duplicates without decrypting (docs/SECURITY.md).
+    var fingerprint as ByteArray? = null;
 
     // Sensitive fields (encrypted at rest).
     var algorithm as Number = Hashes.SHA1;