feat: desktop messaging + pairing + cross-client master-pub attribution (v2.2.0-alpha5)

Two coordinated changes:

1. Desktop client gets a functional Messages section and working pairing
flow, putting it at feature parity with mobile for the v2.2.0 line.

2. Server + both clients teach each other to use the sender's master
Ed25519 (not just their X25519) to address conversations, so a peer
writing from a different linked device still rolls into the same chat.
This is the "new API logic" the desktop scaffold was waiting on.

Server (node/api_relay.go, cmd/node/main.go):
  * /relay/inbox items now carry `sender_ed25519_pub` alongside the
    per-device `sender_pub`. Empty string for pre-v2.2.0 senders.
  * WS `inbox` push summary also includes `sender_ed25519_pub`, so the
    client can skip the refetch when the envelope plainly isn't for
    the chat they're watching.
  * Both existing tests pass.

Mobile client:
  * lib/types.ts Envelope grew `sender_ed25519_pub`; fetchInbox normalises
    it (default '') for older nodes.
  * hooks/useGlobalInbox matches contacts by (master Ed25519 OR legacy
    X25519) so an incoming message from a peer's desktop reuses the
    existing chat instead of creating a duplicate placeholder.
  * hooks/useMessages now takes an optional `contactMasterEd25519` and
    exposes a matchesChat() predicate; WS inbox handler uses it too to
    avoid spurious refetches.
  * chats/[id].tsx passes `contact.address` (master) along with x25519.

Desktop client — all new:
  * src/lib/crypto.ts — tweetnacl hex/base64 helpers, generateKeyFile,
    encryptMessage/decryptMessage, signBase64, shortAddr. Same signatures
    as the mobile lib; uses Chromium's window.crypto, no expo-crypto dep.
  * src/lib/tx.ts — buildTransferTx / buildLinkDeviceTx / buildUnlinkDeviceTx
    + submitTx + humanizeTxError, canonical-bytes identical to mobile.
  * src/lib/relay.ts — fetchInbox, sendEnvelope, resolveRecipientKeys
    (multi-device fan-out with legacy identity.x25519 fallback).
  * src/lib/store.ts — zustand state gets messages{}, unread{},
    activeChat.
  * src/lib/storage.ts — per-chat cache via localStorage (500-msg cap).
  * src/hooks/useInboxPoll — 4s polling loop, addresses conversations
    by master Ed25519, bumps unread unless chat is active.
  * src/sections/messages/* — ChatList (sorted tiles, unread badges),
    Conversation (auto-scroll messages + composer + fan-out send,
    Enter-to-send / Shift+Enter for newline), EmptyConversation.
  * src/auth/Pair.tsx — 6-digit code + device key screen, polls inbox
    for a handshake envelope, assembles the KeyFile on arrival.
  * Welcome.tsx: Pair button now actually routes to <Pair>; imports
    generateKeyFile from lib/crypto (was inlined).

docs/ROADMAP.md delta: alpha5 row flipped to done inline. Alpha6
(feed + wallet) and rc1 (contacts + devices UI + profile) still
pending.

desktop/src/auth/Welcome.tsx

@@ -11,30 +11,19 @@
 // with mobile comes in alpha5.
 
 import React, { useState } from 'react';
-import nacl from 'tweetnacl';
 import { useStore } from '@/lib/store';
 import { saveKeyFile } from '@/lib/storage';
+import { generateKeyFile } from '@/lib/crypto';
 import type { KeyFile } from '@/lib/types';
-
-function bytesToHex(b: Uint8Array): string {
-  return Array.from(b).map(x => x.toString(16).padStart(2, '0')).join('');
-}
-
-function generateKeyFile(): KeyFile {
-  const signKP = nacl.sign.keyPair();
-  const boxKP  = nacl.box.keyPair();
-  return {
-    pub_key:     bytesToHex(signKP.publicKey),
-    priv_key:    bytesToHex(signKP.secretKey),
-    x25519_pub:  bytesToHex(boxKP.publicKey),
-    x25519_priv: bytesToHex(boxKP.secretKey),
-  };
-}
+import { Pair } from './Pair';
 
 export function Welcome(): React.ReactElement {
   const setKeyFile = useStore(s => s.setKeyFile);
   const [busy, setBusy] = useState(false);
   const [err,  setErr]  = useState<string | null>(null);
+  const [screen, setScreen] = useState<'welcome' | 'pair'>('welcome');
+
+  if (screen === 'pair') return <Pair onBack={() => setScreen('welcome')} />;
 
   const onCreate = async () => {
     setBusy(true); setErr(null);
@@ -73,7 +62,8 @@ export function Welcome(): React.ReactElement {
   };
 
   const onPair = () => {
-    setErr('Pair flow lands in v2.2.0-alpha5. For now use Import from a key file exported on your phone.');
+    setErr(null);
+    setScreen('pair');
   };
 
   return (