feat(chat): message model, in-memory store, and receive service

Phase 1 Steps 4-6 (the receive pipeline, minus the App/sync wiring which
lands next).

- chat_message: the in-memory ChatMessage model (direction, kind, txid, cid,
  peer zaddr/pubkey, body, timestamp, payload_position). No libsodium.
- chat_store: threads messages by conversation_id and dedups by
  (txid, payload_position) so re-scanning the chain never double-inserts.
- chat_service: owns the long-lived chat identity keypair (move-disabled,
  wiped on destruction/clear) and the store. ingest() decrypts each Message
  (drops undecryptable ones silently — no plaintext/memo logging), passes a
  ContactRequest's plaintext through, and threads the result. No-op without an
  identity.

Tests: a metadata batch decrypts into a threaded conversation; re-ingest
dedups; a contact request carries through; a wrong identity decrypts nothing;
no-identity ingest is a no-op.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CMakeLists.txt

@@ -413,6 +413,8 @@ set(APP_SOURCES
     src/chat/chat_protocol.cpp
     src/chat/chat_crypto.cpp
     src/chat/chat_identity.cpp
+    src/chat/chat_store.cpp
+    src/chat/chat_service.cpp
     src/wallet/lite_owned_string.cpp
     src/wallet/lite_rollout_policy.cpp
     src/wallet/lite_client_bridge.cpp
@@ -561,6 +563,9 @@ set(APP_HEADERS
     src/chat/chat_protocol.h
     src/chat/chat_crypto.h
     src/chat/chat_identity.h
+    src/chat/chat_message.h
+    src/chat/chat_store.h
+    src/chat/chat_service.h
     src/config/version.h
     src/data/wallet_state.h
     src/data/transaction_history_cache.h
@@ -1011,6 +1016,8 @@ if(BUILD_TESTING)
         src/chat/chat_protocol.cpp
         src/chat/chat_crypto.cpp
         src/chat/chat_identity.cpp
+        src/chat/chat_store.cpp
+        src/chat/chat_service.cpp
         src/wallet/lite_owned_string.cpp
         src/wallet/lite_rollout_policy.cpp
         src/wallet/lite_client_bridge.cpp