harden secure chat backend v1

[creativaPoeta]

Summary

Backend hardening for secure_dm_v1 direct messages:

• adds E2EE device/key bundle endpoints and device revocation support
• validates signed prekey signatures and secure envelope identities
• consumes one-time prekeys server-side with replay protection
• adds encrypted chat media upload handling
• redacts secure chat notifications and push payloads
• blocks plaintext reactions for secure chats
• adds protocol smoke coverage and secure chat rollout documentation
• prepares the transition from qiew-code-dev2.netlify.app to qc-dev2.netlify.app while keeping the old origin temporarily allowed

Validation

• npm.cmd run build
• npm.cmd run test:e2ee

Rollout Notes

Keep this as a draft until the frontend PR is reviewed with it.

Before merging:

• confirm the real staging/production database migration plan
• deploy backend before asking the team to switch Netlify URLs
• keep both old and new Netlify origins temporarily allowed