Fix fingerprint toggle: fallback to device credentials, clearer error messages

lib/auth_service.dart

@@ -61,16 +61,36 @@ class AuthService {
   }
 
   /// Prompt the OS biometric dialog. Returns true on success.
-  Future<bool> authenticateWithBiometrics() async {
+  /// [errorOut] receives a human-readable reason when it fails.
+  Future<bool> authenticateWithBiometrics({String? errorOut}) async {
     try {
-      return await _localAuth.authenticate(
-        localizedReason: 'Gunakan sidik jari untuk membuka Login Vault',
-        options: const AuthenticationOptions(
-          biometricOnly: true,
-          stickyAuth: true,
-        ),
-      );
-    } catch (_) {
+      // Prefer strict biometric (fingerprint). If the device only has
+      // weaker biometrics (face) or none enrolled, fall back to allowing
+      // device credentials so the user isn't hard-blocked.
+      bool ok = false;
+      try {
+        ok = await _localAuth.authenticate(
+          localizedReason: 'Gunakan biometrik untuk membuka Login Vault',
+          options: const AuthenticationOptions(
+            biometricOnly: true,
+            stickyAuth: true,
+          ),
+        );
+      } catch (_) {
+        ok = false;
+      }
+      if (!ok) {
+        ok = await _localAuth.authenticate(
+          localizedReason: 'Gunakan biometrik / kredensial perangkat',
+          options: const AuthenticationOptions(
+            biometricOnly: false,
+            stickyAuth: true,
+          ),
+        );
+      }
+      return ok;
+    } catch (e) {
+      if (errorOut != null) errorOut = e.toString();
       return false;
     }
   }