Securely wipe state.db on exit (#216)

- Add secure_wipe_file() to utils/crypto.py for file overwrites + deletion
- Add secure_wipe parameter to StateManager.stop() method
- Wipes all SQLite WAL files (.db, .db-wal, .db-shm) with 3 passes
- Normal exit now calls state.stop(secure_wipe=True) to clear state database
- Falls back to regular delete if secure wipe fails
- Prevents state.db from persisting on disk after shutdown

core/state.py

@@ -63,8 +63,12 @@ class StateManager:
         self._writer_thread.start()
         logger.info("StateManager writer started (db=%s)", self._db_path)
 
-    def stop(self) -> None:
-        """Flush remaining writes and stop the writer thread."""
+    def stop(self, secure_wipe: bool = False) -> None:
+        """Flush remaining writes and stop the writer thread.
+        
+        Args:
+            secure_wipe: If True, securely overwrite and delete the state database.
+        """
         if not self._running:
             return
         self._running = False
@@ -75,6 +79,22 @@ class StateManager:
         if self._write_conn:
             self._write_conn.close()
             self._write_conn = None
+        
+        # Secure wipe if requested
+        if secure_wipe:
+            from utils.crypto import secure_wipe_file
+            # SQLite creates multiple files in WAL mode: db, db-wal, db-shm
+            for suffix in ["", "-wal", "-shm"]:
+                filepath = self._db_path + suffix
+                if os.path.isfile(filepath):
+                    try:
+                        if secure_wipe_file(filepath, passes=3):
+                            logger.info("Securely wiped %s", filepath)
+                        else:
+                            logger.warning("Secure wipe failed for %s (used regular delete)", filepath)
+                    except Exception as e:
+                        logger.error("Failed to wipe %s: %s", filepath, e)
+        
         logger.info("StateManager stopped")
 
     # ------------------------------------------------------------------