chore(contract): sync flipcash2 protos to dd5e92db

[bmc08gt]

Syncs the flipcash2 contract from e1f4116c to dd5e92db — eleven upstream commits, #103 through #113. Intended to publish as 0.10.0.

Minor rather than patch because one field changes type in place. Everything else is additive.

The breaking change

messaging.v1.EmojiReaction.reacted_by_self (bool, field 3) becomes self_reactor (Reactor, field 3). Same field number, varint to length-delimited, so a 0.9.0 client reading a 0.10.0 response sees a malformed field rather than a missing one.

Android had call sites and they are migrated in its PR. iOS had none — a repo-wide grep for reacted_by_self and reactedBySelf there returns nothing, so the break is a genuine no-op on that platform.

Reactor also gains version (uint64, field 3, gte 1), which becomes the reactor list's sort key — descending, newest first. reacted_ts is display-only now. GetReactorsResponse gains version (field 5); GetReactorsRequest.options.order is ignored and page_size clamps to 100.

Added

Chat muting (#112) — MuteChat / UnmuteChat on chat.v1.Chat, plus MuteState (oneof duration { Timestamp until = 1; Forever forever = 2 }), ViewerState { Settings settings = 1; uint64 version = 10 }, Metadata.viewer_state (field 12), and MetadataUpdate.type gaining ViewerStateChanged viewer_state_changed = 3. push.v1.ChatMetadata gains muted (field 4).

Reporting (#113) — new proto/reporting/v1/reporting_service.proto, package flipcash.reporting.v1. One RPC, Report, over a required target oneof of user / chat / message / blob, plus an optional description capped at 8192. Advisory; a duplicate report is a no-op OK.

Redaction (#103, #108, #109, #110) — messaging.v1.ViewMode { FULL, FULL_OR_REDACTED, REDACTED } and a view_mode field on GetMessageRequest (3), GetMessagesRequest (4), GetDeltaRequest (3) and chat.v1.GetChatRequest (2). Message gains redacted (bool, field 9). event.v1.StreamEventsRequest.Params gains oneof target { ChatPreviewParams chat_preview = 3 } — a bounded-window preview stream, group chats only.

Renumbering

No enum case is inserted mid-list anywhere in this sync. The only enum growth is two cases appended to the end of StreamEventsResponse.Error.Code — NOT_FOUND = 2, STREAM_EXPIRED = 3 — which is safe on the wire and safe for iOS's positional Error*(rawValue:) mapping.

It is not safe for a Swift exhaustive switch, which is a narrower hazard than renumbering but breaks the build the same way. iOS's EventStreamer.handleStreamError needed both cases handled.

blob.v1.BlobMetadata.download_url (field 3) is no longer required.

Behaviour a consumer has to act on

• Keep an emoji's version watermark after its count reaches zero. Dropping it lets a delayed, lower-versioned ADDED resurrect an emptied emoji.
• Muted pushes are still delivered. The server sets ChatMetadata.muted and sends anyway; suppressing the notification is the client's job.
• A timed mute lapses with no server signal. The client owns the countdown. Mute is cleared server-side on leave.

Also in this branch

.swift-version pinning local builds to Xcode's toolchain. swift build fails on every swift.org toolchain I tried — 6.2.1 and 6.3.3 both die resolving Foundation's Data inside grpc-swift-protobuf's plugin — while Apple's Swift from Xcode builds clean. CI already uses Xcode's toolchain, so the file only makes a local swiftly-managed shell match what CI does; swiftly is the only thing that reads it.

scripts/toolchain.env is untouched.

Consumers

Both app branches are built and green against this checkout through the local override, and both are drafts pinning 0.10.0 — they cannot go green until this merges and publishes.

• Android: code-payments/code-android-app#1504
• iOS: code-payments/code-ios-app#804

Merge order: this PR, then publish.yml at 0.10.0, then wait for Central to sync, then mark both app PRs ready.