Fix security audit findings: 3 critical, 7 high

A broad audit surfaced ten critical/high issues across the crypto,
transport, identity, and panic-wipe layers. This fixes all ten.

Critical:
- Nostr DMs were unauthenticated. The NIP-17 seal was signed with a
  throwaway ephemeral key and the receiver never verified it, so anyone
  who knows a recipient's npub could forge messages (and delivery/read
  receipts) into an existing trusted conversation. The seal is now
  signed with the sender's real identity key, and the receiver verifies
  the seal signature and that seal.pubkey == rumor.pubkey.
  NOTE: this is a breaking wire-protocol change (see PR).
- Public BLE messages trusted registry membership instead of the packet
  signature. Since senderID is attacker-controlled, any verified peer
  could be impersonated in public chat. A valid signature from the
  claimed sender is now required before any registry identity is used.
- Unverified announces still persisted the announced identity, letting a
  replayed noisePublicKey overwrite a victim's stored signing key and
  nickname. persistIdentity is now gated on verification.

High:
- Noise decrypt trapped on a 16-19 byte ciphertext (negative prefix
  length after nonce extraction) — a remote crash. Now validated.
- Identity-cache debounce save used Timer.scheduledTimer on a GCD queue
  with no run loop, so it never fired; block/verify/favorite changes
  only persisted on explicit forceSave. Replaced with a
  DispatchSourceTimer on the queue; forceSave is now serialized.
- Identity-cache key load couldn't tell "missing" from a transient
  keychain failure and would regenerate (deleting) the key, orphaning
  the cache. Now uses getIdentityKeyWithResult and falls back to a
  session-only ephemeral key without clobbering the persisted key/cache.
- BLE receive-dedup key lacked a payload digest, so post-handshake
  flushes (queued msgs + delivery/read acks in the same ms) were dropped
  as duplicates. Digest added, matching the ingress registry.
- Maintenance timer was created only in init and never recreated after a
  panic stop/start, silently degrading the mesh until app restart. Now
  recreated in startServices.
- Panic wipe left persisted location state (selected channel, teleport
  set, bookmarks) and cached per-geohash Nostr private keys behind. Both
  are now cleared.
- Panic spawned an orphan NostrRelayManager instead of reusing .shared,
  splitting relay state from every other component. Now reuses .shared.

Tests updated to assert the fixed behavior (announce no longer persists
unverified identities; public messages require a signature; receive
dedup ID includes the payload digest).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bitchatTests/Services/BLEAnnounceHandlerTests.swift

@@ -173,7 +173,10 @@ struct BLEAnnounceHandlerTests {
         #expect(recorder.uiEventDeliveries.count == 1)
         #expect(recorder.uiEventDeliveries.first?.notifyPeerConnected == false)
         #expect(recorder.uiEventDeliveries.first?.scheduleInitialSync == false)
-        #expect(recorder.persistedIdentities.count == 1)
+        // Identity persistence MUST NOT occur for unverified announces:
+        // persisting would let an attacker who replays a victim's noisePublicKey
+        // overwrite the victim's stored signing key/nickname (identity poisoning).
+        #expect(recorder.persistedIdentities.isEmpty)
         #expect(recorder.trackedPackets.count == 1)
         #expect(recorder.announceBacks == 1)
     }

bitchatTests/Services/BLEPublicMessageHandlerTests.swift

@@ -59,13 +59,17 @@ struct BLEPublicMessageHandlerTests {
         let now = Date(timeIntervalSince1970: 1_000)
         let recorder = Recorder()
         recorder.peers = [remotePeerID: makePeerInfo(remotePeerID, nickname: "Alice", isVerified: true)]
+        // A valid packet signature is required even for a registry-verified peer:
+        // senderID is spoofable, so registry membership alone is not authentication.
+        recorder.signedName = "SignedAlice"
         let handler = makeHandler(recorder: recorder, now: now)
         let packet = makeMessagePacket(sender: remotePeerID, content: "hello mesh", timestamp: timestamp(now))
 
         handler.handle(packet, from: remotePeerID)
 
         #expect(recorder.peersSnapshotReads == 1)
-        #expect(recorder.signedNameQueries.isEmpty)
+        // Signature is verified, then the registry's collision-resolved name is preferred.
+        #expect(recorder.signedNameQueries == [remotePeerID])
         #expect(recorder.trackedPackets.count == 1)
         #expect(recorder.selfBroadcastTakes.isEmpty)
         #expect(recorder.deliveries.count == 1)
@@ -154,6 +158,7 @@ struct BLEPublicMessageHandlerTests {
         let now = Date(timeIntervalSince1970: 1_000)
         let recorder = Recorder()
         recorder.peers = [remotePeerID: makePeerInfo(remotePeerID, nickname: "Alice", isVerified: true)]
+        recorder.signedName = "SignedAlice"
         let handler = makeHandler(recorder: recorder, now: now)
         let packet = makeMessagePacket(sender: remotePeerID, payload: Data([0xFF, 0xFE, 0xFD]), timestamp: timestamp(now))
 
@@ -187,6 +192,7 @@ struct BLEPublicMessageHandlerTests {
         let now = Date(timeIntervalSince1970: 1_000)
         let recorder = Recorder()
         recorder.peers = [remotePeerID: makePeerInfo(remotePeerID, nickname: "Alice", isVerified: true)]
+        recorder.signedName = "SignedAlice"
         let handler = makeHandler(recorder: recorder, now: now)
         let packet = makeMessagePacket(
             sender: remotePeerID,

bitchatTests/Services/BLEReceivePipelineTests.swift

@@ -14,7 +14,10 @@ struct BLEReceivePipelineTests {
         let context = BLEReceivePipeline.context(for: packet, localPeerID: local)
 
         #expect(context.senderID == sender)
-        #expect(context.messageID == "\(sender)-1234-\(MessageType.message.rawValue)")
+        // The message ID includes a payload digest so distinct packets sharing a
+        // sender/timestamp(ms)/type are not collapsed as duplicates.
+        let digest = packet.payload.sha256Hash().prefix(4).hexEncodedString()
+        #expect(context.messageID == "\(sender)-1234-\(MessageType.message.rawValue)-\(digest)")
         #expect(context.messageType == .message)
         #expect(context.shouldDeduplicate)
         #expect(context.logsHandlingDetails)