fix(app): accept incoming calls, restore from recovery phrase, duress session isolation, message loss

Calls: `call` was missing from the known content types, so every offer was
acknowledged and dropped; the call screen column now fills the width (the
avatar jumped left after hang-up); a ring started from a push ends after
12 s when no offer arrives; STUN fallback when no TURN credentials.
Registration: X-Sepot-Identity-Proof lets a new device reclaim an existing
identity; retry backs off from 30 s to 10 min and exposes a conflict flag.
Prekeys: PrekeysLow triggers a batch of 50 one-time prekeys via POST
/v1/keys; the signed prekey rotates weekly, the Kyber prekey monthly.
Messaging: crypto operations run serially (concurrent encrypts derived the
same message key); stop() waits for in-flight deliveries (auto-lock between
decrypt and persist lost messages); disappearing-message cleanup no longer
overwrites fresh messages; a push wake-up reconnects stale connections; the
outbox carries polls and mentions; length limits on wire input.
Storage: a duress session never exposes the real identity or phrase, does
not start networking and cannot touch the keystore; deleting data in a
duress session leaves the real account alone; PIN guessing is throttled
(5 misses, then 30 s doubling up to 15 min); the duress blob shares the salt
so unlock time does not reveal which PIN was entered; iOS keychain items are
this-device only; biometrics are biometric-only; screen security defaults
to on and is applied after unlock; tapjacking filter in MainActivity.
Tests: content types, shared-salt unwrap, duress isolation.

app/lib/models/attachment.dart

@@ -1,6 +1,8 @@
 import 'dart:convert';
 import 'dart:typed_data';
 
+import 'package:sepot/core/constants/app_constants.dart';
+
 /// Stav přenosu přílohy — čistě lokální (na drát nikdy nejde).
 enum AttachmentTransferState {
   /// Přijatá zpráva, blob se ještě nezačal stahovat.
@@ -94,14 +96,22 @@ class AttachmentMeta {
   /// (blob_id formát hlídá AttachmentStore, tady rozsahy a typy).
   factory AttachmentMeta.fromWire(Map<String, dynamic> wire) {
     final size = wire['s'] as int;
-    if (size <= 0 || size > 512 * 1024 * 1024) {
+    if (size <= 0 || size > AppConstants.maxAttachmentBytes) {
       throw const FormatException('implausible attachment size');
     }
-    // Krypto pole MUSÍ být validní base64 (jinak je meta k ničemu);
-    // vyhodí FormatException → zpráva se zahodí jako vadná.
-    base64Decode(wire['k'] as String);
-    base64Decode(wire['n'] as String);
-    base64Decode(wire['d'] as String);
+    // Krypto pole MUSÍ být validní base64 správné délky (AES-256-GCM klíč,
+    // 96bitová nonce, SHA-256 digest) — jinak by vadná meta prošla a
+    // selhala až při otevření přílohy, kdy je obálka dávno ACKnutá.
+    if (base64Decode(wire['k'] as String).length != 32 ||
+        base64Decode(wire['n'] as String).length != 12 ||
+        base64Decode(wire['d'] as String).length != 32) {
+      throw const FormatException('invalid attachment key material');
+    }
+    final name = wire['name'] as String?;
+    final mime = wire['mime'] as String;
+    if ((name != null && name.length > 255) || mime.length > 100) {
+      throw const FormatException('attachment name or mime too long');
+    }
     // Vadný náhled zprávu nezabíjí — UI ukáže placeholder a ostrá fotka
     // se stáhne z blobu. base64Decode v build() by shodil celou bublinu.
     var thumb = wire['th'] as String?;
@@ -118,8 +128,8 @@ class AttachmentMeta {
       nonceB64: wire['n'] as String,
       digestB64: wire['d'] as String,
       size: size,
-      mime: wire['mime'] as String,
-      name: wire['name'] as String?,
+      mime: mime,
+      name: name,
       width: wire['w'] as int?,
       height: wire['h'] as int?,
       thumbB64: thumb,

app/lib/models/identity.dart

@@ -146,6 +146,9 @@ class LocalIdentity {
 /// kontaktu poslat první zpráva. Obě pole jsou náhodná — s identitou je
 /// spojuje jen sám uživatel tím, že je sdílí ve svém odkazu.
 class PublicIdentity {
+  /// Nejvyšší délka jména z odkazu/QR — delší odkaz je vadný vstup.
+  static const maxDisplayNameLength = 64;
+
   PublicIdentity({
     required this.displayName,
     required this.identityKey,
@@ -214,7 +217,14 @@ class PublicIdentity {
           as Map<String, dynamic>;
       if (map['v'] != 2) return null;
       final identityKey = base64Decode(map['ik'] as String);
-      if (identityKey.length != 33) return null;
+      // 33 B = typový bajt 0x05 + Curve25519; jiný prefix libsignal odmítne
+      // až při první zprávě, tady ho odmítneme hned.
+      if (identityKey.length != 33 || identityKey[0] != 0x05) return null;
+      final aid = map['aid'] as String?;
+      // Relay dává 32 hex znaků; starší testovací odkazy kratší — hex a strop stačí.
+      if (aid != null && !RegExp(r'^[0-9a-f]{8,64}$').hasMatch(aid)) return null;
+      final rawName = (map['n'] as String).trim();
+      if (rawName.length > maxDisplayNameLength) return null;
       final da = map['da'] as String?;
       Uint8List? deliveryAddress;
       if (da != null) {
@@ -224,10 +234,10 @@ class PublicIdentity {
         if (deliveryAddress.length != 32) return null;
       }
       return PublicIdentity(
-        displayName: map['n'] as String,
+        displayName: rawName,
         identityKey: identityKey,
         createdAt: DateTime.parse(map['ts'] as String),
-        accountId: map['aid'] as String?,
+        accountId: aid,
         deliveryAddress: deliveryAddress,
       );
     } catch (_) {