Derives a Bearer token from pin and persists it to the platform's secure storage. Callers should pass the raw PIN; the derivation (PBKDF2-HMAC-SHA256) happens inside the implementation so the raw PIN never has to leave the entry screen.