fix: Settings crash, photo preview before sending, incoming-content hardening

Settings crashed with a TypeError: the profile card passed a
SepotFingerprint object where the localized string formatter expects
a String (hidden behind a `dynamic` parameter). Also fixes RangeError
in avatar initials (empty names, double spaces) and switches initials
to grapheme clusters so emoji don't get split.

New photo preview screen: a captured or picked photo no longer sends
immediately — it opens in a preview with freehand drawing (7 colours,
undo), draggable text overlay, 90° rotation and a caption field.
Nothing leaves the device until Send is tapped.

Incoming-content hardening: decryption and content processing are now
separated in the delivery path. Once an envelope is decrypted the
ratchet has advanced, so redelivery can never help — permanently
malformed content (FormatException/TypeError) is acked and dropped
instead of poisoning the queue on every reconnect. Attachment metadata
now validates base64 of the crypto fields up front, and a corrupt
inline thumbnail no longer breaks bubble rendering.

PNG without real transparency (screenshots, edited photos) is now
re-encoded as JPEG — several times smaller on the wire.

Tests: 116 (new widget tests for Settings and the photo preview,
AttachmentMeta wire validation).

app/lib/features/qr_pairing/qr_scan_screen.dart

@@ -127,7 +127,7 @@ class _QrScanScreenState extends ConsumerState<QrScanScreen> {
                 children: [
                   Container(
                     decoration: const BoxDecoration(
-                      color: Colors.red, // Jakákoliv neprůhledná barva
+                      color: Colors.red, // Jakákoliv nepůhledná barva
                       backgroundBlendMode: BlendMode.dstOut,
                     ),
                   ),
@@ -198,11 +198,9 @@ class _QrScanScreenState extends ConsumerState<QrScanScreen> {
               radius: 32,
               backgroundColor: SepotColors.ember.withValues(alpha: 0.1),
               child: Text(
-                // Naskenovaná identita může mít prázdný displayName
-                // (i podvržený QR); guard proti pádu na substring(0,1).
-                identity.displayName.isNotEmpty
-                    ? identity.displayName.substring(0, 1).toUpperCase()
-                    : '?',
+                identity.displayName.isEmpty
+                    ? '?'
+                    : identity.displayName.characters.first.toUpperCase(),
                 style: const TextStyle(
                   fontSize: 24,
                   fontWeight: FontWeight.w600,