fix: authorize inbound envelopes, repair messenger lifecycle, wire read receipts

[ffaerber]

Inbound envelopes were authenticated (signature recovers to from) but never
authorized — nothing checked that the sender was entitled to the effect they
were asking for. Plus a set of lifecycle and correctness defects found in the
same pass.

Security

• envelope: bind msgId to keccak(from, nonce, ts) at verify time. It was
  attacker-chosen, and it keys the dedup set, the outbox, and ack/read
  correlation, so a sender could collide with someone else's message.
• reliability: only the addressee may ack/read a message. A forged receipt
  also cancelled the retry timer, suppressing retransmission of a message the
  real recipient never received.
• calls: scope call-answer/ice/call-hangup to the peer on the other end of the
  call, and require a matching callId on hangup — a missing one was treated as
  a wildcard, letting any peer tear down the active call.
• groups: gate inbound group/state on the group's current admin (not the
  payload's own admin field, which let a member promote themselves), require
  self to be a member, and validate payload shape. Group messages are now
  dropped unless the group is known and the sender is in it; messages that
  race ahead of their group/state are held in a bounded buffer and replayed,
  since the auto-ack means the sender will not retry.

Correctness

• messenger: clear the cached feed identity when switching to a wallet that
  has none, instead of silently reusing the previous wallet's feed key.
• messenger: drop handles on teardown so the UI cannot write to closed
  IndexedDB databases while the next messenger is being built.
• messenger: a group send that reaches nobody now persists a uniquely-keyed
  row marked failed and throws, rather than writing a zero-hash row marked
  sent that the next such failure would overwrite.
• media: stop caching rejected resolves, which made one transient bee error
  permanent for that reference (and surfaced as an unhandled rejection).
• transport: refresh msgIds on re-mark so dedup eviction is LRU, not FIFO.
• calls: report false from toggleAudio/toggleVideo when no track of that kind
  exists.
• ContactRegistry: clamp getUsers against the remaining span so a large limit
  cannot revert with an arithmetic panic.

Features completed

• Read receipts and unread counts were dead code: markRead was never called
  and unread was hardcoded to 0. Viewing a conversation now clears unread
  state and emits one receipt per message, and the sidebar shows unread
  badges for 1:1 and group chats.

Tests: 38 new cases (162 total). 33 of them fail against the pre-fix source;
the contract change was verified by executing both versions in an EVM.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01KnBiaAgJUWmo2WuAbKLYUi