feat(chat): add a Control memo header type for on-chain conversation signals

Introduces HushChatHeaderType::Control — a self-addressed control signal
(delete / restore / mark-sensitive) that rides a chat tx as a header memo
carrying an `op`, paired with a plaintext label payload so it groups like a
normal header/payload pair. The op VALUE is not restricted at parse time so a
future op reaches newer clients and is ignored by older ones; unknown header
types still fail-closed (grouped as an invalid header, never surfaced, never a
crash), preserving forward-compat.

Foundation for the on-chain chat delete/restore feature (Phase A).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/chat/chat_protocol.cpp

@@ -81,6 +81,8 @@ const char* hushChatHeaderTypeName(HushChatHeaderType type)
         return "Memo";
     case HushChatHeaderType::ContactRequest:
         return "Cont";
+    case HushChatHeaderType::Control:
+        return "Ctrl";
     }
     return "Unknown";
 }
@@ -138,7 +140,15 @@ HushChatHeaderParseResult parseHushChatHeaderMemo(const std::string& memo)
         header.type = HushChatHeaderType::Message;
     } else if (type == "Cont") {
         header.type = HushChatHeaderType::ContactRequest;
+    } else if (type == "Ctrl") {
+        header.type = HushChatHeaderType::Control;
+        // A control signal carries a non-empty op ("del"/"res"/...); the op VALUE isn't restricted here so
+        // a future op reaches newer clients and is ignored by the reducer on older ones (forward-compat).
+        if (!readRequiredString(object, "op", header.op, error)) return fail(error);
+        if (header.op.empty()) return fail("control op is empty");
     } else {
+        // Unknown type (older client seeing a newer memo type): fail here so it is grouped as an invalid
+        // header and ignored, never crashing. Keep this the catch-all.
         return fail("unknown HushChat header type");
     }
 
@@ -299,6 +309,7 @@ HushChatTransactionExtractionResult extractHushChatTransactionMetadata(
         HushChatTransactionMetadata metadata;
         metadata.txid = transaction.txid;
         metadata.type = pair.header.type;
+        metadata.op = pair.header.op;   // Control only; empty for Message/ContactRequest
         metadata.conversation_id = pair.header.conversation_id;
         metadata.reply_zaddr = pair.header.reply_zaddr;
         metadata.header_position = pair.header_position;

src/chat/chat_protocol.h

@@ -12,7 +12,8 @@ namespace dragonx::chat {
 
 enum class HushChatHeaderType {
     Message,
-    ContactRequest
+    ContactRequest,
+    Control        // a self-addressed control signal (delete / restore / mark sensitive); carries an `op`
 };
 
 struct HushChatHeader {
@@ -21,6 +22,7 @@ struct HushChatHeader {
     std::string reply_zaddr;
     std::string conversation_id;
     HushChatHeaderType type = HushChatHeaderType::Message;
+    std::string op;   // Control only ("del" / "res" / "sensitive" / "unsensitive" / future ops); empty otherwise
     std::string secretstream_header_hex;
     std::string public_key_hex;
     // Optional sender-stamped compose time (header "ts", Unix seconds). 0 = absent (older sender) → the
@@ -73,6 +75,7 @@ struct HushChatTransactionInput {
 struct HushChatTransactionMetadata {
     std::string txid;
     HushChatHeaderType type = HushChatHeaderType::Message;
+    std::string op;                      // Control only: the control op ("del"/"res"/...); empty otherwise
     std::string conversation_id;
     std::string reply_zaddr;
     std::size_t header_position = 0;