fix: validate biometric type at runtime to prevent spoofing

[collinsezedike]

Summary

Adds a runtime type guard for BiometricType values so that a value returned from an abstract/mocked authentication method cannot bypass the compile-time type and be used as-is. getSupportedBiometricType now validates its resolved value against VALID_BIOMETRIC_TYPES before returning it, closing the gap where mocked or test environments could spoof an arbitrary string as a valid biometric type.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Testing Done

• Unit Tests

Added tests covering isValidBiometricType for all valid biometric types, invalid strings (including near-miss casing/whitespace), and non-string values (null, undefined, number, boolean, object, array, symbol).

Security Considerations

• Are all user inputs validated?

The biometric type returned from the native/abstract authentication layer is now validated at runtime via isValidBiometricType before use, preventing spoofed values in mocked or test environments.

Performance Considerations

N/A - no rendering or list changes.

Checklist

• I have read the CONTRIBUTING guide.
• My code follows the style guidelines of this project.
• I have updated the documentation accordingly.
• Are there architectural changes? If so, is there an Architectural Decision Record (ADR)?

Closes #782

[drips-wave]

@collinsezedike Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[collinsezedike]

Checked the failing CI jobs on this PR. All of them trace back to issues that already exist on main and are unrelated to this change:

• npm ci fails repo-wide because package-lock.json is out of sync with package.json (missing typescript@5.9.3), which cascades into the test, bundle-size, npm audit, and e2e jobs. This reproduces on main's own recent merge commits.
• Syntax & Type Check has pre-existing TypeScript errors in unrelated files (socketReconnect.test.ts, healthDashboardStore.test.ts, requestQueue tests, formCache tests, etc.) that predate this branch.
• Native Build (Android/iOS) and the k6 latency job also fail on main's own merge commits.

Keeping this PR scoped to the biometric type validation described in issue #782 rather than bundling in unrelated repo-wide fixes. Happy to address the lockfile/TS debt separately if maintainers want it split out.

[RUKAYAT-CODER]

Thank you for contributing to the project