fix：参考金值，研听，研值工程通用通用工程公共能力，重点对比网络请求、登录认证、状态管理、本地存储、WebView、推送、版本更新、一键登录、主题/UI 等模块，确定后续统一整改方案

lib/common/storage/storage_keys.dart

@@ -2,6 +2,7 @@ const storageThemeMode = 'theme_mode';
 const storagePrivacyAgreed = 'privacy_agreed'; // Android 首启隐私同意（设备采集门控）
 const storageIosStartupSeen = 'ios_startup_seen'; // iOS 首次启动页已展示
 const storageJinzhiHoldings = 'jinzhi_holdings';
+const storageJinzhiHoldingsDeleted = 'jinzhi_holdings_deleted';
 const storageJinzhiAmountHidden = 'jinzhi_amount_hidden';
 const storageJinzhiRecycleDiscounts = 'jinzhi_recycle_discounts';
 const storageJinzhiPurityPresets = 'jinzhi_purity_presets';
@@ -18,6 +19,16 @@ const storageMallHomeBadgeSeen = 'jinzhi_mall_home_badge_seen';
 const storageLegacyAccessToken = 'access_token';
 const storageAuthSessionActive = 'auth_session_active';
 
+// Account-scoped secure values. They are intentionally listed even before
+// every feature is implemented so account deletion has one complete cleanup
+// boundary. Access tokens must never be reused as biometric credentials.
+const secureAccessToken = 'access_token';
+const secureLegacyJwtToken = 'jwt_token';
+const secureDeviceId = 'device_id';
+const secureMallCredential = 'mall_credential';
+const secureRefreshToken = 'refresh_token';
+const secureBiometricCredential = 'biometric_credential';
+
 // 设备/广告标识。由各自的 SDK/ATT 流程写入，DeviceHeaderService 读出注入
 // header；未写入则为空、注入时被过滤。
 const storageDeviceToken = 'device_token'; // 推送 token