Here's a slightly different take on the matter: Of the users who would bother to crack your game's data format or decompile it and change it, how many do you think are actually willing to pay for these things? In other words, if these users were to try and fail to cheat your game, do you think they would then give up and pay you money for the items?
Furthermore, are these people going to influence other users elsewhere?
If this is a game where users interact with each other (e.g. a MMO), and these paid items give users an advantage over other users, then the items, purchases, and player interactions need to be tracked on your server, so that your server can verify all interactions involving items, that the items were paid for and not yet used. The client side cannot be trusted; there's no way to definitively prevent hacking.
If this is not the case (e.g. Temple Run), why waste your effort trying to stop users who probably wouldn't pay you anyway, and who aren't affecting other paying users?
As for your other two sub-questions, just store them however you want to store your data. You already found the different ways to store data, as you posted in your answer, so read through them, figure out which ones will satisfy your requirements, and then pick whichever one you think would be best and go with it. All of them survive shutdown and reboot (thus the concept of "storage", versus just an in-memory variable), and the ability to extend them is up to you to engineer.