Remove noise service exposure; single-owner selection state

Transport callers no longer reach the raw NoiseEncryptionService:
getNoiseService() is deleted in favor of narrow purpose-named Transport
methods (session public key, identity fingerprint, static/signing keys,
sign/verify, callback installation). VerificationService now reaches
crypto through the transport, so it can no longer pin a stale service
across a panic reset. myPeerID/myNickname become private(set); the
existing setNickname mutator is the sole nickname path.

ConversationStore is now the sole owner of private-chat selection:
PrivateChatManager.selectedPeer is a published read-only mirror, and
startChat/endChat mutate through the store intent. The bridge method
and its five call sites are deleted, removing a latent bug where a
stale manager selection pushed back into the store could resurrect a
just-removed conversation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bitchatTests/ProtocolContractTests.swift

@@ -21,7 +21,6 @@ private final class DefaultTransportProbe: Transport {
     let subject = CurrentValueSubject<[TransportPeerSnapshot], Never>([])
     let myPeerID = PeerID(str: "0011223344556677")
     var myNickname = "Tester"
-    private let keychain = MockKeychain()
     private(set) var sentMessages: [(content: String, mentions: [String])] = []
 
     var peerSnapshotPublisher: AnyPublisher<[TransportPeerSnapshot], Never> {
@@ -40,7 +39,6 @@ private final class DefaultTransportProbe: Transport {
     func getFingerprint(for peerID: PeerID) -> String? { nil }
     func getNoiseSessionState(for peerID: PeerID) -> LazyHandshakeState { .none }
     func triggerHandshake(with peerID: PeerID) {}
-    func getNoiseService() -> NoiseEncryptionService { NoiseEncryptionService(keychain: keychain) }
     func sendMessage(_ content: String, mentions: [String]) { sentMessages.append((content, mentions)) }
     func sendPrivateMessage(_ content: String, to peerID: PeerID, recipientNickname: String, messageID: String) {}
     func sendReadReceipt(_ receipt: ReadReceipt, to peerID: PeerID) {}