fix(security): treat a new identity key as a message request, never as a known contact

A stranger could pick the display name of an existing contact ("Mom")
and appear as that contact. Messages from a key that is not in the
contact list now open a message request labelled "(unknown)": no
replies, read receipts, typing indicators, calls or name in
notifications until the user accepts it and names the contact
themselves. Names that look like an existing contact (case, diacritics,
Cyrillic/Greek homoglyphs, invisible characters) also show a warning in
the real contact's chat.

When the relay account of a known contact shows up with a different
key, the chat shows "safety number changed", verification is cleared
and the session that now belongs to the other key is dropped before
sending, so a reply never goes to the new key.

app/lib/features/contacts/contacts_screen.dart

@@ -95,7 +95,9 @@ class _ContactsScreenState extends ConsumerState<ContactsScreen> {
           Expanded(
             child: contactsAsync.when(
               data: (contacts) {
+                // Žádosti o zprávu kontakty nejsou — žijí jen v seznamu chatů.
                 final filtered = contacts.where((c) {
+                  if (!c.accepted) return false;
                   if (_searchQuery.isEmpty) return true;
                   return c.displayName.toLowerCase().contains(_searchQuery) ||
                       c.sepotId.toLowerCase().contains(_searchQuery);