new option: Lock on Startup Only

apps/weblibre/lib/features/user/data/models/auth_settings.dart

@@ -23,7 +23,7 @@ import 'package:json_annotation/json_annotation.dart';
 
 part 'auth_settings.g.dart';
 
-enum AutoLockMode { background, timeout }
+enum AutoLockMode { background, timeout, startup }
 
 @CopyWith()
 @JsonSerializable()
@@ -56,6 +56,10 @@ class AuthSettings with FastEquatable {
     return copyWith(autoLockMode: AutoLockMode.timeout, timeout: value);
   }
 
+  AuthSettings withStartupLock() {
+    return copyWith(autoLockMode: AutoLockMode.startup);
+  }
+
   factory AuthSettings.fromJson(Map<String, dynamic> json) =>
       _$AuthSettingsFromJson(json);
 

apps/weblibre/lib/features/user/data/models/auth_settings.g.dart

@@ -105,4 +105,5 @@ Map<String, dynamic> _$AuthSettingsToJson(AuthSettings instance) =>
 const _$AutoLockModeEnumMap = {
   AutoLockMode.background: 'background',
   AutoLockMode.timeout: 'timeout',
+  AutoLockMode.startup: 'startup',
 };

apps/weblibre/lib/features/user/domain/presentation/screens/profile_edit.dart

@@ -68,6 +68,7 @@ class ProfileEditScreen extends HookConsumerWidget {
           .authenticate(
             authKey: profileAccessAuthKey(profile!.id),
             localizedReason: 'Require authentication for profile',
+            settings: authSettings,
           );
 
       if (!authResult) {
@@ -222,6 +223,14 @@ class _AuthSection extends StatelessWidget {
                         title: Text('Lock After Timeout'),
                         subtitle: Text('Lock after a period of inactivity'),
                       ),
+                      RadioListTile.adaptive(
+                        value: AutoLockMode.startup,
+                        title: Text('Lock on Startup Only'),
+                        subtitle: Text(
+                          'Unlock once when the app starts; stay unlocked '
+                          'until the app is fully closed',
+                        ),
+                      ),
                     ],
                   ),
                 ),

apps/weblibre/lib/features/user/domain/services/local_authentication.dart

@@ -46,6 +46,8 @@ class LocalAuthenticationService extends _$LocalAuthenticationService {
     }
 
     // Background mode cache stays valid until app background eviction.
+    // Startup mode cache is never evicted, so it stays valid for the whole
+    // process lifetime.
     return true;
   }