Make Noise-service replacement atomic with the identity swap

During a panic reset, the new NoiseEncryptionService was assigned
before the identity barrier ran, so a previously queued send block
could observe the new crypto service alongside the old peer ID -
signing with the new identity while carrying the old sender. The
service teardown, replacement, callback configuration, and derived
identity swap now run inside one messageQueue barrier
(refreshPeerIdentity executes inline via its re-entrancy check), so
queued sends see either the complete old identity or the complete new
one, never a mix.

Found by Codex review on #1336.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bitchat/Services/BLE/BLEService.swift

@@ -317,6 +317,12 @@ final class BLEService: NSObject {
         }
         disconnectNotifyDebouncer.removeAll()
 
+        // The crypto-service replacement and the derived identity swap must be
+        // one atomic unit with respect to messageQueue senders: a queued send
+        // must never observe the new Noise service alongside the old peer ID
+        // (it would sign with the new identity while carrying the old sender).
+        // refreshPeerIdentity() executes inline here via its re-entrancy check.
+        messageQueue.sync(flags: .barrier) {
             noiseService.clearEphemeralStateForPanic()
             noiseService.clearPersistentIdentity()
 
@@ -324,6 +330,7 @@ final class BLEService: NSObject {
             noiseService = newNoise
             configureNoiseServiceCallbacks(for: newNoise)
             refreshPeerIdentity()
+        }
         restartGossipManager()
 
         setNickname(currentNickname)