Improve message reliability, media responsiveness, and desktop sign-in

[Xare123]

Summary

This draft improves message delivery integrity, large-sync responsiveness,
attachment handling, conversation media memory, rendering safety, desktop Apple
sign-in, and build diagnostics across Android and Windows.

The newest Android changes bound retained attachment data and tighten media
ownership without changing message routing or files stored on disk. They also
close several reliability gaps found during extended Pixel testing.

User impact

• Conversations remain responsive during large syncs and media-heavy history.
• User-requested attachments are prioritized and transient downloads retry.
• Encoded image, sticker, parsed-text, and metadata caches have explicit limits.
• Video initialization is lazy, and widgets release their audio and video
  players when they leave the tree.
• Full-screen images yield horizontal drags to the conversation gallery while
  preserving pinch-to-zoom and zoomed-image panning.
• Missing reaction parents and malformed metadata no longer destroy the
  transcript rendering surface.
• Temporary reconnects are less likely to drop sends or incoming messages.
• Apple provisioning no longer waits forever at Fetching Bottles.
• Desktop uses trusted-device 2FA instead of an Android-only Bluetooth flow.

Root causes addressed

• Socket callbacks could be registered after connection setup, allowing early
  events to be missed.
• Send and receive paths treated temporary reconnect states as terminal
  failures.
• Large CloudKit batches did too much synchronous work and produced high-volume
  per-message logs.
• Conversations retained unbounded encoded previews and media-controller
  references.
• Audio and video ownership was divided between widgets and conversation
  controllers, which made cleanup and double-disposal difficult.
• Concurrent image requests could duplicate reads and retain widget context.
• PhotoView captured horizontal gestures before the surrounding media
  PageView, preventing normal image-to-image swiping.
• Reaction rendering assumed that every parent message was available locally.
• Notification and Rust logger initialization could run more than once.
• Shared-profile retries included permanent failures.
• Apple recovery-data retrieval had no timeout.
• Windows OpenSSL builds received escaped NDK paths and could leave a stale APK
  looking like a successful native build.

What changed

Messaging and sync reliability

• Register push callbacks before connecting and preserve incoming
  acknowledgements.
• Retry transient sends and attachment streams with bounded backoff.
• Keep tapped attachments at the front of the download queue.
• Yield during large sync batches and remove raw or high-volume payload logging.
• Bound the in-memory diagnostic log and redact registration-adjacent secrets.
• Harden reply-thread assembly, message refresh, group participants, reactions,
  and widget/controller lifecycle paths.

Media and memory lifecycle

• Add byte-aware and entry-aware LRU caches for conversation data.
• Limit encoded image previews to 32 MiB or 48 entries.
• Limit sticker data to 16 MiB or 64 entries.
• Limit parsed text to 256 entries and metadata previews to 64 entries.
• Coalesce concurrent requests for the same image and avoid retaining
  BuildContext in the load queue.
• Add PhotoView's horizontal gesture scope around the existing media PageView;
  the existing zoom callback continues disabling paging while magnified.
• Keep audio and video players widget-owned, lazily initialize video, cancel
  listeners during disposal, and pause only already-registered conversation
  controllers when the app backgrounds.
• Document ownership, budgets, measurement, rollback, and known limitations in
  docs/MEMORY_MANAGEMENT.md.

Startup, provisioning, and builds

• Make notification initialization idempotent before relay reminders schedule.
• Initialize the process-global Rust logger only once.
• Retry shared profiles only for transient network, timeout, or unavailable
  failures.
• Add a 30-second timeout to Apple recovery-data retrieval.
• Normalize Windows NDK tool paths before POSIX OpenSSL build scripts consume
  them.
• Add a Windows build wrapper that deletes only the previous target APK and
  rejects output missing Flutter, Dart AOT, or the Rust ARM64 library.

Validation

Automated and static checks

• flutter test test/helpers/memory test/helpers/message_helper_test.dart test/services/conversation_view_controller_test.dart --reporter expanded
  passed, 14 of 14 tests.
• cargo metadata --locked --no-deps --format-version 1 passed.
• Targeted Flutter analysis completed with zero errors. The remaining warnings
  and informational findings were present in the branch baseline.
• git diff --check passed.
• The generalized PowerShell build wrapper parses successfully.

Android artifact and device

• Verified Alpha profile APK size: 441,452,218 bytes.
• SHA-256:
  F57736145E5FAAEEB52388764E985A89890621BD383DC563F579D93C329E2C1B.
• The build output and archived installation APK are byte-identical.
• The APK contains non-empty ARM64 libflutter.so, libapp.so, and
  librust_lib_bluebubbles.so.
• Installed in place on a Pixel 10 Pro with existing app data preserved.
• Confirmed installed package version 1.15.0, version code 20002227, and a
  running application process.
• Manual use covered message synchronization, conversation navigation, text,
  and large attachment downloads. The user reported a substantially smoother
  interface and fast large-file completion.

The device result is intentionally qualitative. There is no matched baseline
trace, so this draft does not claim a percentage improvement in throughput,
frame time, PSS, or swap.

Remaining before ready for review

• Wait for CI on the final draft SHA.
• Repeat controlled baseline and changed runs for frame timing, peak PSS,
  post-workload PSS, and SwapPss.
• Complete longer playback, navigation, background/resume, relay, and locked
  phone endurance checks.
• Run attachment and media integration tests beyond the focused cache tests.
• Validate the Windows x64 artifact by installing and launching that exact
  artifact.

Host-side cargo check cannot complete on the current Windows ARM64 host because
legacy ring and OpenSSL build dependencies require a different native
toolchain. The Android native library was validated through the successful APK
build and archive inspection.

The Windows ARM64 lane remains experimental and is not presented as a usable
ARM64 package in this draft.