Integrate live phone and watch remote prototype with guarded motion control

Adapters/SecureStorage/README.md

@@ -1,3 +1,24 @@
 # SecureStorage
 
-Planned adapter: iPhone Keychain token and per-TV trust storage. No live implementation is present. Owner: workstream E in docs/agents/README.md. The integrator must establish injected protocols and source/test target membership before implementation. Keep platform APIs out of pure package modules.
+This adapter stores the TV token, certificate pin, and pairing state in the
+iPhone Keychain under an opaque television UUID. It is injected through
+`KeychainClient` for deterministic tests and conforms to the frozen
+`TVAuthorizationStore` protocol from `TVTransport`.
+
+The candidate accessibility is `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`:
+it is the narrowest device-only option that can support a phone-lock relay after
+the first unlock. It is unavailable before the first unlock after reboot and has
+not yet been validated on a signed iPhone. The stronger
+`WhenUnlockedThisDeviceOnly` option remains available for a deployment that
+does not require locked-phone relay.
+
+Certificate trust is fail-closed. A self-signed certificate is accepted only
+after an explicit user approval supplied to `approveCertificate`; the exact
+SHA-256 leaf fingerprint is then pinned to that opaque TV ID. A changed
+fingerprint returns `requiresReapproval` and is never silently accepted. The
+stored source records that first-use fingerprinting came from an unauthenticated
+connection, so it is not presented as proof of TV identity.
+
+`forgetTelevision` removes the complete Keychain record. `deleteToken` revokes
+pairing while preserving the trust pin; `deleteTrust` removes trust material.
+Neither tokens nor trust records are sent to WatchConnectivity or cloud storage.