feat(chat): add a Control memo header type for on-chain conversation signals

Introduces HushChatHeaderType::Control — a self-addressed control signal
(delete / restore / mark-sensitive) that rides a chat tx as a header memo
carrying an `op`, paired with a plaintext label payload so it groups like a
normal header/payload pair. The op VALUE is not restricted at parse time so a
future op reaches newer clients and is ignored by older ones; unknown header
types still fail-closed (grouped as an invalid header, never surfaced, never a
crash), preserving forward-compat.

Foundation for the on-chain chat delete/restore feature (Phase A).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/chat/chat_protocol.h

@@ -12,7 +12,8 @@ namespace dragonx::chat {
 
 enum class HushChatHeaderType {
     Message,
-    ContactRequest
+    ContactRequest,
+    Control        // a self-addressed control signal (delete / restore / mark sensitive); carries an `op`
 };
 
 struct HushChatHeader {
@@ -21,6 +22,7 @@ struct HushChatHeader {
     std::string reply_zaddr;
     std::string conversation_id;
     HushChatHeaderType type = HushChatHeaderType::Message;
+    std::string op;   // Control only ("del" / "res" / "sensitive" / "unsensitive" / future ops); empty otherwise
     std::string secretstream_header_hex;
     std::string public_key_hex;
     // Optional sender-stamped compose time (header "ts", Unix seconds). 0 = absent (older sender) → the
@@ -73,6 +75,7 @@ struct HushChatTransactionInput {
 struct HushChatTransactionMetadata {
     std::string txid;
     HushChatHeaderType type = HushChatHeaderType::Message;
+    std::string op;                      // Control only: the control op ("del"/"res"/...); empty otherwise
     std::string conversation_id;
     std::string reply_zaddr;
     std::size_t header_position = 0;