Securely wipe state.db on exit (#216)

- Add secure_wipe_file() to utils/crypto.py for file overwrites + deletion
- Add secure_wipe parameter to StateManager.stop() method
- Wipes all SQLite WAL files (.db, .db-wal, .db-shm) with 3 passes
- Normal exit now calls state.stop(secure_wipe=True) to clear state database
- Falls back to regular delete if secure wipe fails
- Prevents state.db from persisting on disk after shutdown

utils/crypto.py

@@ -246,3 +246,39 @@ class LUKSContainer:
     @property
     def is_open(self) -> bool:
         return Path(self.device_path).exists()
+
+
+def secure_wipe_file(filepath: str, passes: int = 1) -> bool:
+    """Securely wipe a file by overwriting with random data before deletion.
+    
+    Args:
+        filepath: Path to file to wipe
+        passes: Number of overwrite passes (default 1, use 3 for stronger security)
+        
+    Returns:
+        True if file was successfully wiped, False otherwise
+    """
+    try:
+        file_size = os.path.getsize(filepath)
+        if file_size == 0:
+            # Empty file, just delete
+            os.unlink(filepath)
+            return True
+        
+        # Overwrite passes
+        for _ in range(passes):
+            with open(filepath, "wb") as f:
+                f.write(os.urandom(file_size))
+                f.flush()
+                os.fsync(f.fileno())
+        
+        # Delete the file
+        os.unlink(filepath)
+        return True
+    except Exception as e:
+        # Fallback: try regular delete if secure wipe fails
+        try:
+            os.unlink(filepath)
+            return False
+        except Exception:
+            return False