Single source of truth for VaultError code list across TS, Kotlin, and Obj-C++

[LiranCohen]

Summary

The set of VAULT_ERROR_* codes raised by the biometric vault is currently restated by hand in four places:

Surface	Where	What it declares
specs/NativeBiometricVault.ts	TurboModule spec	Documentation strings
src/lib/enbox/biometric-vault.ts	JS wrapper	VAULT_ERROR_CODES tuple + mapNativeErrorToVaultError
android/.../NativeBiometricVaultModule.kt	Android impl	companion object constants
ios/.../RCTNativeBiometricVault.mm	iOS impl	inline literal strings

Adding VAULT_ERROR_OPERATION_IN_PROGRESS for the per-alias serialization contract required edits in all four — and an out-of-band update to JS unit tests because the canonical tuple lives only in JS. Drift between platforms is currently caught only by reviewer attention.

Goal

A single declaration of the error-code namespace that the JS layer, the spec contract, and (where feasible) both native modules consume.

Possible Directions

1. Generate native constants from the TS spec at build time (Codegen-friendly).
2. Hand-author a JSON manifest that all three platforms import.
3. Keep four declarations but add a CI lint that diffs them.

Acceptance Criteria

• Adding a new vault error code requires editing exactly one file.
• A failing CI check fires when the four surfaces drift.
• mapNativeErrorToVaultError no longer carries a hand-maintained switch keyed on string literals; it consumes the same source list.

Out of Scope

• Renaming existing error codes (would be a breaking contract change for callers).