fix(chat,rpc): address adversarial review of the chat backlog

Four confirmed findings from the review pass:

SECURITY — B7 was incomplete:
- The single-key Export dialog (key_export_dialog) still used plain call() for
  z_exportkey/dumpprivkey/z_exportviewingkey — a live spending-key leak on the
  most common per-address export path, missed by the B7 commit.
- callSecret() zeros the raw body but the parsed json holds its OWN heap copy of
  the secret; several callers did .get<string>() on a temporary json and freed
  that copy un-wiped.
  Fix: add RPCClient::callSecretString() — returns the bare-string result with
  BOTH the raw body AND the json node zeroed, so callers can't forget. Route
  key_export_dialog (×2), exportPrivateKey, and export_all_keys (×2) through it;
  scrub the z_exportmnemonic json node in seed_wallet_creator (object result);
  also wipe the transient key copies, the displayed s_key on reset, and the
  aggregated export-all `keys` buffer.

CHAT:
- Jump-to-latest pill: SetCursorScreenPos moved the parent cursor and never
  restored it, so the composer footer rendered ~8px too high while scrolled up.
  Save + restore the cursor around the pill.
- New-message toast: gating on a chatUnreadCount() watermark delta could be
  swallowed when an outgoing echo (wall-clock) pushed the seen-watermark past a
  later reply's block time. ingest() now reports the cids it appended; the toast
  fires when any is a non-muted conversation — skew-proof, still mute-aware.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/ui/windows/chat_tab.cpp

@@ -525,14 +525,18 @@ void RenderChatTab(App* app)
                 atBottom = ImGui::GetScrollY() >= ImGui::GetScrollMaxY() - 4.0f;
             }
             ImGui::EndChild();
-            // Jump-to-latest pill when scrolled up (Q9).
+            // Jump-to-latest pill when scrolled up (Q9). SetCursorScreenPos moves the parent cursor to
+            // the child's bottom edge; save + restore it so the composer footer below stays anchored
+            // (otherwise it renders ~8px too high only while the pill is shown).
             if (!atBottom) {
+                const ImVec2 savedCursor = ImGui::GetCursorScreenPos();
                 const ImVec2 pill(msgWinMin.x + msgWinSize.x - 84.0f * dp, msgWinMin.y + msgWinSize.y - 34.0f * dp);
                 ImGui::SetCursorScreenPos(pill);
                 ImGui::PushStyleColor(ImGuiCol_Button,        ImGui::ColorConvertU32ToFloat4(material::WithAlpha(material::Primary(), 220)));
                 ImGui::PushStyleColor(ImGuiCol_ButtonHovered, ImGui::ColorConvertU32ToFloat4(material::Primary()));
                 if (ImGui::Button(TR("chat_jump_latest"), ImVec2(74.0f * dp, 26.0f * dp))) s_scroll_to_cid = sel->cid;
                 ImGui::PopStyleColor(2);
+                ImGui::SetCursorScreenPos(savedCursor);
             }
 
             // Composer footer: message input + send (only once we know the peer's key), else a hint.