Locking the app

A device can be set to lock the app when it goes into the background, so reopening needs a fingerprint. The obvious way to build that is a prompt in front of the existing session, but it would be theatre: the session is still there and still valid, and anything able to read the phone's storage walks straight past the prompt while the app claims to be protected. So locking actually ends the session and discards the tokens, and unlocking is a real passkey sign-in against the server. That is why it needs an enrolled passkey: without one there would be nothing to unlock with. It is a per-device choice made by the person using the app, under Account, and it is off until they turn it on.