fix: Settings crash, photo preview before sending, incoming-content hardening

Settings crashed with a TypeError: the profile card passed a
SepotFingerprint object where the localized string formatter expects
a String (hidden behind a `dynamic` parameter). Also fixes RangeError
in avatar initials (empty names, double spaces) and switches initials
to grapheme clusters so emoji don't get split.

New photo preview screen: a captured or picked photo no longer sends
immediately — it opens in a preview with freehand drawing (7 colours,
undo), draggable text overlay, 90° rotation and a caption field.
Nothing leaves the device until Send is tapped.

Incoming-content hardening: decryption and content processing are now
separated in the delivery path. Once an envelope is decrypted the
ratchet has advanced, so redelivery can never help — permanently
malformed content (FormatException/TypeError) is acked and dropped
instead of poisoning the queue on every reconnect. Attachment metadata
now validates base64 of the crypto fields up front, and a corrupt
inline thumbnail no longer breaks bubble rendering.

PNG without real transparency (screenshots, edited photos) is now
re-encoded as JPEG — several times smaller on the wire.

Tests: 116 (new widget tests for Settings and the photo preview,
AttachmentMeta wire validation).

app/lib/l10n/app_it.arb

@@ -348,5 +348,14 @@
   "contactsErrorAlreadyExists": "Il contatto esiste già",
   "commonAppTagline": "Messenger privato",
   "commonE2eBadgeCompact": "E2E",
-  "commonE2eBadgeFull": "Cifrato end-to-end"
+  "commonE2eBadgeFull": "Cifrato end-to-end",
+  "photoPreviewCaptionHint": "Aggiungi una didascalia…",
+  "photoPreviewDraw": "Disegna",
+  "photoPreviewAddText": "Aggiungi testo",
+  "photoPreviewRotate": "Ruota",
+  "photoPreviewUndo": "Annulla",
+  "photoPreviewSend": "Invia",
+  "photoPreviewTextDialogTitle": "Testo sulla foto",
+  "photoPreviewRemoveText": "Rimuovi",
+  "photoPreviewDecodeFailed": "Impossibile caricare la foto"
 }