fix(chat): wipe typed plaintext on a wallet switch + per-thread draft

Audit B1/B5/B8:
- The chat composer / new-conversation buffers are file-static char[]; on a wallet
  switch or lock the plaintext a user typed for wallet A (a private message, or a
  recipient z-address) resurfaced verbatim in wallet B's composer and lingered
  unwiped in RAM. Add ui::ResetChatTab() (sodium_memzero the buffers + clear the
  selection ids) and call it from App::resetChatSession().
- Wipe the single composer draft when the active conversation changes, so text
  typed for one contact can't be sent to another (B5).
- Refresh the stale "read-only / Phase 3" docs — composing/sending is wired (B8).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app_network.cpp

@@ -34,6 +34,7 @@
 #include "rpc/rpc_worker.h"
 #include "rpc/connection.h"
 #include "chat/chat_identity.h"  // deriveChatIdentityFromSecret for HushChat identity provisioning
+#include "ui/windows/chat_tab.h"  // ui::ResetChatTab — wipe chat UI plaintext on a wallet switch
 #include <sodium.h>              // sodium_memzero for wiping the fetched mnemonic
 #include <cctype>
 #include "config/settings.h"
@@ -2672,6 +2673,7 @@ void App::resetChatSession()
     // Drop identity + decrypted plaintext in RAM, lock the seed-encrypted DB, re-arm provisioning.
     chat_service_.clearIdentity();
     chat_service_.store().clear();
+    ui::ResetChatTab();  // wipe the chat UI's typed plaintext + selection so it can't leak into the next wallet
     chat_db_.lock();
     chat_identity_provisioned_ = false;
     chat_identity_fetch_in_flight_ = false;