fix(chat): harden reply-target + scrub legacy secret (B2/B4)

B4: the legacy chat-identity fallback copied the z_exportkey spending key out of
the RPC response and let the temporary json destruct un-zeroed. Mirror the
mnemonic path — take our copy, then sodium_memzero the json's own buffer.

B2: the memo header's peer z-address / cid ride OUTSIDE the secretstream AEAD, so
trusting the newest message's header let a later message redirect our replies or
splice threads. Pin the reply target (and displayed peer) to the EARLIEST
(establishing) message instead of the latest, at both the send and display sites.
Because ChatStore returned filtered INSERTION order (a scan harvests txids in
set/hash order — not chronological), "earliest" wasn't reliable; ChatStore::
conversation now returns messages sorted by (timestamp, txid, payload_position),
which also fixes out-of-order thread rendering and the last-message preview.

A complete fix binds z+cid into the AEAD additional-data, but that's a coordinated
HushChat/SDXLite wire-format change; this pin hardens the reply target without it.
Adversarially verified; the store-ordering gap it surfaced is fixed here.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/ui/windows/chat_tab.cpp

@@ -144,9 +144,9 @@ void RenderChatTab(App* app)
         ConvSummary c;
         c.cid = cid;
         c.count = static_cast<int>(messages.size());
-        for (const auto& m : messages) {  // last non-empty peer z-addr / key across the thread
-            if (!m.peer_zaddr.empty()) c.peerZaddr = m.peer_zaddr;
-            if (!m.peer_public_key_hex.empty()) c.peerPubKey = m.peer_public_key_hex;
+        for (const auto& m : messages) {  // pin to the EARLIEST (establishing) peer z-addr / key (B2 — the
+            if (c.peerZaddr.empty() && !m.peer_zaddr.empty()) c.peerZaddr = m.peer_zaddr;   // memo header rides
+            if (c.peerPubKey.empty() && !m.peer_public_key_hex.empty()) c.peerPubKey = m.peer_public_key_hex; // outside the AEAD)
         }
         const auto& last = messages.back();
         c.lastBody = last.body;