fix(security): treat a new identity key as a message request, never as a known contact

A stranger could pick the display name of an existing contact ("Mom")
and appear as that contact. Messages from a key that is not in the
contact list now open a message request labelled "(unknown)": no
replies, read receipts, typing indicators, calls or name in
notifications until the user accepts it and names the contact
themselves. Names that look like an existing contact (case, diacritics,
Cyrillic/Greek homoglyphs, invisible characters) also show a warning in
the real contact's chat.

When the relay account of a known contact shows up with a different
key, the chat shows "safety number changed", verification is cleared
and the session that now belongs to the other key is dropped before
sending, so a reply never goes to the new key.

app/lib/features/groups/create_group_screen.dart

@@ -81,7 +81,9 @@ class _CreateGroupScreenState extends ConsumerState<CreateGroupScreen> {
         : null;
     final contactsAsync = ref.watch(contactsProvider);
     final contacts = (contactsAsync.valueOrNull ?? [])
-        .where((c) => !c.blocked)
+        // Do skupiny jen lidi, které jsem přijal — žádost o zprávu by
+        // jinak dostala roster všech členů pod jménem, které si vymyslela.
+        .where((c) => !c.blocked && c.accepted)
         .where((c) => existing == null || !existing.memberIds.contains(c.id))
         .toList();
     // Já jsem v memberIds existující skupiny; nová skupina mě přidá sama.