fix(android): declare KeySpec so the native PBKDF2 call resolves, and report why it fails

generateSecret takes a KeySpec; passing a JObject made the bridge emit a signature no method matches, and the call failed at runtime. Swallowed as 'unavailable', which hid my own mistake for a full test round - the failure now carries its exception message.

Measured on device: the Pascal PBKDF2 takes 6651 ms, unusable per unlock. AES-GCM through JNI works, plaintext and hash match the vector, so the container format is validated end to end.

mainApk.pas

@@ -129,7 +129,7 @@ begin
         LKey := DeriveKeyPBKDF2Native(TESTVECTOR_PASSWORD, LSalt, 600000, 32);
         LSw.Stop;
         if LKey = nil then
-          Log('  indisponible sur cette plateforme')
+          Log('  indisponible : ' + LastNativeError)
         else
         begin
           LKeyHex := LowerCase(THash.DigestAsString(LKey));