feat: desktop messaging + pairing + cross-client master-pub attribution (v2.2.0-alpha5)

Two coordinated changes:

1. Desktop client gets a functional Messages section and working pairing
flow, putting it at feature parity with mobile for the v2.2.0 line.

2. Server + both clients teach each other to use the sender's master
Ed25519 (not just their X25519) to address conversations, so a peer
writing from a different linked device still rolls into the same chat.
This is the "new API logic" the desktop scaffold was waiting on.

Server (node/api_relay.go, cmd/node/main.go):
  * /relay/inbox items now carry `sender_ed25519_pub` alongside the
    per-device `sender_pub`. Empty string for pre-v2.2.0 senders.
  * WS `inbox` push summary also includes `sender_ed25519_pub`, so the
    client can skip the refetch when the envelope plainly isn't for
    the chat they're watching.
  * Both existing tests pass.

Mobile client:
  * lib/types.ts Envelope grew `sender_ed25519_pub`; fetchInbox normalises
    it (default '') for older nodes.
  * hooks/useGlobalInbox matches contacts by (master Ed25519 OR legacy
    X25519) so an incoming message from a peer's desktop reuses the
    existing chat instead of creating a duplicate placeholder.
  * hooks/useMessages now takes an optional `contactMasterEd25519` and
    exposes a matchesChat() predicate; WS inbox handler uses it too to
    avoid spurious refetches.
  * chats/[id].tsx passes `contact.address` (master) along with x25519.

Desktop client — all new:
  * src/lib/crypto.ts — tweetnacl hex/base64 helpers, generateKeyFile,
    encryptMessage/decryptMessage, signBase64, shortAddr. Same signatures
    as the mobile lib; uses Chromium's window.crypto, no expo-crypto dep.
  * src/lib/tx.ts — buildTransferTx / buildLinkDeviceTx / buildUnlinkDeviceTx
    + submitTx + humanizeTxError, canonical-bytes identical to mobile.
  * src/lib/relay.ts — fetchInbox, sendEnvelope, resolveRecipientKeys
    (multi-device fan-out with legacy identity.x25519 fallback).
  * src/lib/store.ts — zustand state gets messages{}, unread{},
    activeChat.
  * src/lib/storage.ts — per-chat cache via localStorage (500-msg cap).
  * src/hooks/useInboxPoll — 4s polling loop, addresses conversations
    by master Ed25519, bumps unread unless chat is active.
  * src/sections/messages/* — ChatList (sorted tiles, unread badges),
    Conversation (auto-scroll messages + composer + fan-out send,
    Enter-to-send / Shift+Enter for newline), EmptyConversation.
  * src/auth/Pair.tsx — 6-digit code + device key screen, polls inbox
    for a handshake envelope, assembles the KeyFile on arrival.
  * Welcome.tsx: Pair button now actually routes to <Pair>; imports
    generateKeyFile from lib/crypto (was inlined).

docs/ROADMAP.md delta: alpha5 row flipped to done inline. Alpha6
(feed + wallet) and rc1 (contacts + devices UI + profile) still
pending.

client-app/app/(app)/chats/[id].tsx

@@ -107,7 +107,7 @@ export default function ChatScreen() {
   const [selectedIds, setSelectedIds] = useState<Set<string>>(new Set());
   const selectionMode = selectedIds.size > 0;
 
-  useMessages(contact?.x25519Pub ?? '');
+  useMessages(contact?.x25519Pub ?? '', contact?.address);
 
   // ── Typing indicator от peer'а ─────────────────────────────────────────
   useEffect(() => {

client-app/hooks/useGlobalInbox.ts

@@ -52,10 +52,13 @@ export function useGlobalInbox() {
       try {
         const envelopes = await fetchInbox(keyFile.x25519_pub);
         for (const env of envelopes) {
-          // Найти контакт по sender_pub — если не знакомый, игнорим
-          // (для MVP; в future можно показывать "unknown sender").
-          const c = contactsRef.current.find(
-            x => x.x25519Pub === env.sender_pub,
+          // Attribution (v2.2.0+): prefer the envelope's master Ed25519
+          // so messages from any of the sender's linked devices roll
+          // into a single chat. Fall back to legacy X25519-based lookup
+          // for pre-v2.2.0 senders that left the field empty.
+          const c = contactsRef.current.find(x =>
+            (env.sender_ed25519_pub && x.address === env.sender_ed25519_pub) ||
+            x.x25519Pub === env.sender_pub,
           );
           if (!c) continue;
 

client-app/hooks/useMessages.ts

@@ -24,10 +24,26 @@ import { tryParsePostRef } from '@/lib/forwardPost';
 const FALLBACK_POLL_INTERVAL  = 30_000;  // HTTP poll when WS is down
 const WS_GRACE_BEFORE_POLLING = 15_000;  // don't start polling immediately on disconnect
 
-export function useMessages(contactX25519: string) {
+/**
+ * useMessages — mounts per-chat inbox consumption. Accepts:
+ *   - contactX25519: the legacy/primary X25519 for the contact.
+ *   - contactMasterEd25519 (optional, v2.2.0+): the contact's master
+ *     identity so we can attribute envelopes from any of their
+ *     linked devices to this conversation.
+ *
+ * Matching rule: an envelope belongs to this chat when
+ *     env.sender_ed25519_pub === contactMasterEd25519  (v2.2.0 path)
+ *  OR env.sender_pub         === contactX25519         (legacy path)
+ */
+export function useMessages(contactX25519: string, contactMasterEd25519?: string) {
   const keyFile   = useStore(s => s.keyFile);
   const appendMsg = useStore(s => s.appendMessage);
 
+  const matchesChat = useCallback((env: { sender_pub: string; sender_ed25519_pub: string }): boolean => {
+    if (contactMasterEd25519 && env.sender_ed25519_pub === contactMasterEd25519) return true;
+    return env.sender_pub === contactX25519;
+  }, [contactX25519, contactMasterEd25519]);
+
   // Подгружаем кэш сообщений из AsyncStorage при открытии чата.
   // Релей держит envelope'ы всего 7 дней, поэтому без чтения кэша
   // история старше недели пропадает при каждом рестарте приложения.
@@ -48,8 +64,8 @@ export function useMessages(contactX25519: string) {
     try {
       const envelopes = await fetchInbox(keyFile.x25519_pub);
       for (const env of envelopes) {
-        // Only process messages from this contact
-        if (env.sender_pub !== contactX25519) continue;
+        // Only process messages that belong to this chat (see matchesChat).
+        if (!matchesChat(env)) continue;
 
         const text = decryptMessage(
           env.ciphertext,
@@ -130,10 +146,17 @@ export function useMessages(contactX25519: string) {
     // the handler so we only render messages in THIS chat.
     const offInbox = ws.subscribe('inbox:' + keyFile.x25519_pub, (frame) => {
       if (frame.event !== 'inbox') return;
-      const d = frame.data as { sender_pub?: string } | undefined;
-      // Optimisation: if the envelope is from a different peer, skip the
-      // whole refetch — we'd just drop it in the sender filter below anyway.
-      if (d?.sender_pub && d.sender_pub !== contactX25519) return;
+      const d = frame.data as {
+        sender_pub?: string; sender_ed25519_pub?: string;
+      } | undefined;
+      // Optimisation: if the envelope definitely isn't for this chat,
+      // skip the whole refetch. Multi-device aware — the peer may be
+      // writing from any of their linked devices (different X25519
+      // pubs), so we check against their master Ed25519 too.
+      if (d && !matchesChat({
+        sender_pub:         d.sender_pub ?? '',
+        sender_ed25519_pub: d.sender_ed25519_pub ?? '',
+      })) return;
       pullAndDecrypt();
     });
 

client-app/lib/api.ts

@@ -262,14 +262,17 @@ export async function getTxHistory(pubkey: string, limit = 50): Promise<TxRecord
  * совместимости с crypto.ts (decryptMessage принимает hex).
  */
 interface InboxItemWire {
-  id:            string;
-  sender_pub:    string;
-  recipient_pub: string;
-  fee_ut?:       number;
-  sent_at:       number;
-  sent_at_human?: string;
-  nonce:         string;   // base64
-  ciphertext:    string;   // base64
+  id:                 string;
+  sender_pub:         string;
+  /** sender_ed25519_pub was added in v2.2.0; older nodes omit it.
+      Default to empty string when missing. */
+  sender_ed25519_pub?: string;
+  recipient_pub:      string;
+  fee_ut?:            number;
+  sent_at:            number;
+  sent_at_human?:     string;
+  nonce:              string;   // base64
+  ciphertext:         string;   // base64
 }
 
 interface InboxResponseWire {
@@ -326,12 +329,13 @@ export async function fetchInbox(x25519PubHex: string): Promise<Envelope[]> {
   const resp = await get<InboxResponseWire>(`/relay/inbox?pub=${x25519PubHex}`);
   const items = Array.isArray(resp?.items) ? resp.items : [];
   return items.map((it): Envelope => ({
-    id:            it.id,
-    sender_pub:    it.sender_pub,
-    recipient_pub: it.recipient_pub,
-    nonce:         bytesToHex(base64ToBytes(it.nonce)),
-    ciphertext:    bytesToHex(base64ToBytes(it.ciphertext)),
-    timestamp:     it.sent_at ?? 0,
+    id:                it.id,
+    sender_pub:        it.sender_pub,
+    sender_ed25519_pub: it.sender_ed25519_pub ?? '',
+    recipient_pub:     it.recipient_pub,
+    nonce:             bytesToHex(base64ToBytes(it.nonce)),
+    ciphertext:        bytesToHex(base64ToBytes(it.ciphertext)),
+    timestamp:         it.sent_at ?? 0,
   }));
 }
 

client-app/lib/types.ts

@@ -34,7 +34,19 @@ export interface Contact {
 export interface Envelope {
   /** sha256(nonce||ciphertext)[:16] hex — stable server-assigned id. */
   id:            string;
-  sender_pub:    string;  // X25519 hex
+  sender_pub:    string;  // X25519 hex (this envelope's per-device sender key)
+  /**
+   * sender_ed25519_pub (v2.2.0+): the sender's master Ed25519 identity.
+   * Multiple X25519 pubs under the same identity all share one master —
+   * clients use THIS to group messages into a single conversation even
+   * when the sender replies from different devices.
+   *
+   * Empty string on legacy envelopes from pre-v2.2.0 senders. Consumers
+   * should fall back to `sender_pub` in that case (keeps old clients'
+   * messages visible, even if attribution is per-X25519 rather than
+   * per-identity).
+   */
+  sender_ed25519_pub: string;
   recipient_pub: string;  // X25519 hex
   nonce:         string;  // hex 24 bytes
   ciphertext:    string;  // hex NaCl box