fix: Tier-1 UX robustness — backup/export integrity, verified installs, input validation

From the app-wide robustness audit (calibrated to the import-key dialog). These
are the safety-critical fixes; several could cost users funds:

- Backup/export false success (FUND LOSS): exportAllKeys pre-seeded a header, so
  a keyless result (the usual case when the wallet is encrypted+locked) still
  looked non-empty and backupWallet wrote a private-key-less file and reported
  "Backup saved". Now exportAllKeys returns an exported count; backupWallet and
  the export-all dialog refuse to write / report success on 0 keys, disclose the
  count, flag partial results as INCOMPLETE, and the backup dialog confirms
  before overwriting an existing file (+ trims the path).
- Bootstrap: fail CLOSED — refuse to install an unverified multi-GB archive when
  no checksum is published (was `return true`), mirroring the xmrig/daemon updaters.
- Restore-from-seed: require a valid BIP39 word count (12/15/18/21/24) with a live
  "should be 24 words — you have N" hint instead of accepting any non-empty text.
- Encryption passphrase: detect leading/trailing whitespace and BLOCK with a
  warning (not a silent trim, which would change the passphrase and lock the user
  out).
- Receive payment QR: emit the canonical `drgx:` scheme with a URL-encoded memo
  via a new shared util::buildPaymentUri (the request-payment dialog now routes
  through it too, so they can't diverge); the old "dragonx:" + raw memo was
  unparseable by the wallet's own scanner.

Also clamps the receive "Recent Received" list to the 4 most recent (companion to
the recent-lists commit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/ui/windows/receive_tab.cpp

@@ -12,6 +12,7 @@
 #include "../../app.h"
 #include "../../config/settings.h"
 #include "../../util/i18n.h"
+#include "../../util/payment_uri.h"
 #include "../../util/platform.h"
 #include "../../util/text_format.h"
 #include "../../config/version.h"
@@ -365,6 +366,7 @@ static void RenderRecentReceived(const AddressInfo& /* addr */,
         if (tx.type != "receive" && tx.type != "mined") continue;
         recvs.push_back(&tx);
     }
+    if (recvs.size() > 4) recvs.resize(4);  // show only the 4 most recent (newest-first)
 
     float listH = std::max(rowH, ImGui::GetContentRegionAvail().y);
 
@@ -539,11 +541,10 @@ void RenderReceiveTab(App* app)
     // Generate QR data
     std::string qr_data = selected.address;
     if (s_request_amount > 0) {
-        qr_data = std::string("dragonx:") + selected.address +
-                  "?amount=" + std::to_string(s_request_amount);
-        if (s_request_memo[0] && isZ) {
-            qr_data += "&memo=" + std::string(s_request_memo);
-        }
+        // Canonical, URL-encoded "drgx:" URI via the shared builder. The old inline code emitted an
+        // unparseable "dragonx:" scheme and appended the memo raw (spaces/&/= corrupted the QR).
+        qr_data = util::buildPaymentUri(selected.address, s_request_amount, "",
+                                        (s_request_memo[0] && isZ) ? std::string(s_request_memo) : std::string());
     }
     if (qr_data != s_cached_qr_data) {
         if (s_qr_texture) {