fix(app): accept incoming calls, restore from recovery phrase, duress session isolation, message loss

Calls: `call` was missing from the known content types, so every offer was
acknowledged and dropped; the call screen column now fills the width (the
avatar jumped left after hang-up); a ring started from a push ends after
12 s when no offer arrives; STUN fallback when no TURN credentials.
Registration: X-Sepot-Identity-Proof lets a new device reclaim an existing
identity; retry backs off from 30 s to 10 min and exposes a conflict flag.
Prekeys: PrekeysLow triggers a batch of 50 one-time prekeys via POST
/v1/keys; the signed prekey rotates weekly, the Kyber prekey monthly.
Messaging: crypto operations run serially (concurrent encrypts derived the
same message key); stop() waits for in-flight deliveries (auto-lock between
decrypt and persist lost messages); disappearing-message cleanup no longer
overwrites fresh messages; a push wake-up reconnects stale connections; the
outbox carries polls and mentions; length limits on wire input.
Storage: a duress session never exposes the real identity or phrase, does
not start networking and cannot touch the keystore; deleting data in a
duress session leaves the real account alone; PIN guessing is throttled
(5 misses, then 30 s doubling up to 15 min); the duress blob shares the salt
so unlock time does not reveal which PIN was entered; iOS keychain items are
this-device only; biometrics are biometric-only; screen security defaults
to on and is applied after unlock; tapjacking filter in MainActivity.
Tests: content types, shared-salt unwrap, duress isolation.

app/lib/features/auth/pin_lock_screen.dart

@@ -4,10 +4,12 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
 import 'package:local_auth/local_auth.dart';
 import 'package:sepot/core/crypto/dek_wrap.dart';
+import 'package:sepot/core/storage/secure_storage.dart' show PinLockedException;
 import 'package:sepot/core/l10n/l10n.dart';
 import 'package:sepot/core/theme/app_theme.dart';
 import 'package:sepot/providers/messaging_provider.dart';
 import 'package:sepot/providers/push_provider.dart';
+import 'package:sepot/providers/settings_provider.dart';
 import 'package:sepot/providers/storage_provider.dart';
 import 'package:sepot/widgets/sepot_logo.dart';
 
@@ -41,7 +43,10 @@ class _PinLockScreenState extends ConsumerState<PinLockScreen> {
     try {
       final ok = await LocalAuthentication().authenticate(
         localizedReason: unlockReason,
-        options: const AuthenticationOptions(stickyAuth: true),
+        // biometricOnly: zámek telefonu (PIN/vzor zařízení) nesmí Šepot
+        // odemknout — obešel by Argon2id ochranu DEK slabším faktorem.
+        options: const AuthenticationOptions(
+            stickyAuth: true, biometricOnly: true),
       );
       if (!ok) return; // uživatel zrušil → zůstává PIN
       await storage.unlockWithBiometrics();
@@ -222,6 +227,9 @@ class _PinLockScreenState extends ConsumerState<PinLockScreen> {
   void _restartMessagingAfterUnlock() {
     ref.invalidate(messagingStartProvider);
     ref.invalidate(pushInitProvider);
+    // Zabezpečení obrazovky se čte z DB — před odemčením provider nic
+    // neaplikoval, teď má skutečnou hodnotu.
+    ref.invalidate(screenSecurityProvider);
   }
 
   Future<void> _verifyPin() async {
@@ -234,12 +242,22 @@ class _PinLockScreenState extends ConsumerState<PinLockScreen> {
       _restartMessagingAfterUnlock();
       if (mounted) context.go('/chats');
     } on WrongPinException {
+      final locked = await ref.read(storageProvider).pinLockRemaining();
+      if (!mounted) return;
       setState(() {
-        _error = context.l10n.pinWrong2;
+        _error = locked == null
+            ? context.l10n.pinWrong2
+            : context.l10n.pinLockedFor(locked.inSeconds);
         _pin = '';
         _isVerifying = false;
       });
       HapticFeedback.heavyImpact();
+    } on PinLockedException catch (e) {
+      setState(() {
+        _error = context.l10n.pinLockedFor(e.remaining.inSeconds);
+        _pin = '';
+        _isVerifying = false;
+      });
     } on StateError {
       // Wrapped DEK neexistuje — nekonzistentní stav, zpět na onboarding
       if (mounted) context.go('/onboarding');