fix(chat,rpc): address adversarial review of the chat backlog

Four confirmed findings from the review pass:

SECURITY — B7 was incomplete:
- The single-key Export dialog (key_export_dialog) still used plain call() for
  z_exportkey/dumpprivkey/z_exportviewingkey — a live spending-key leak on the
  most common per-address export path, missed by the B7 commit.
- callSecret() zeros the raw body but the parsed json holds its OWN heap copy of
  the secret; several callers did .get<string>() on a temporary json and freed
  that copy un-wiped.
  Fix: add RPCClient::callSecretString() — returns the bare-string result with
  BOTH the raw body AND the json node zeroed, so callers can't forget. Route
  key_export_dialog (×2), exportPrivateKey, and export_all_keys (×2) through it;
  scrub the z_exportmnemonic json node in seed_wallet_creator (object result);
  also wipe the transient key copies, the displayed s_key on reset, and the
  aggregated export-all `keys` buffer.

CHAT:
- Jump-to-latest pill: SetCursorScreenPos moved the parent cursor and never
  restored it, so the composer footer rendered ~8px too high while scrolled up.
  Save + restore the cursor around the pill.
- New-message toast: gating on a chatUnreadCount() watermark delta could be
  swallowed when an outgoing echo (wall-clock) pushed the seen-watermark past a
  later reply's block time. ingest() now reports the cids it appended; the toast
  fires when any is a non-muted conversation — skew-proof, still mute-aware.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/chat/chat_service.h

@@ -40,9 +40,13 @@ public:
     // when the txid isn't present. Newly-added messages are also persisted (if a database is
     // attached). Returns the number of NEW messages added; 0 with no identity. Undecryptable
     // Messages are dropped silently (no logging of memo/plaintext).
+    // When `newIncomingCids` is non-null it is filled with the conversation ids of the genuinely-new
+    // incoming (non-request) messages appended this call — a reliable "a new message arrived here"
+    // signal for notifications that doesn't depend on any timestamp/seen-watermark comparison.
     int ingest(const std::vector<HushChatTransactionMetadata>& metadata,
                const std::unordered_map<std::string, std::int64_t>& txTimestamps,
-               std::int64_t fallbackTimestamp = 0);
+               std::int64_t fallbackTimestamp = 0,
+               std::vector<std::string>* newIncomingCids = nullptr);
 
     // Attach a persistent backing store (Phase 2). Not owned. Pass nullptr to detach. New messages
     // from ingest() are written through; loadFromDatabase() rehydrates the in-memory store from it.