#247 fix(chat-store): preserve shared history deletion and identities

Follow-up to #246 / #245. Synthetic fixtures independently reproduce all three review findings on merged base 5ee0050c279987abf16c6418d9ff9c1251ce975a.

Clear/delete-chat now retires covered pending history envelopes in the same transaction, retaining deduplication keys. Late download completions and redeliveries cannot restore deleted history after restart; other chats and attachments outside the action's timestamp/key range remain eligible.

Missing-target shared edits/revokes now create read-backfill placeholders without unread attention, while existing live targets retain their original eligibility. Aggregated reaction keys are translated from the sharing account's perspective so later live replacement/removal addresses the same author.

Protocol evidence and exact preserved bundle hashes/module offsets are in docs/shared-group-history.md, using whatspec 46f630441389e703e04ff3fc012192cf80fdd4ba (schema 4.4.0, Web 2.3000.1047483476). This is synthetic validation, not an authenticated reproduction or a new server-contract claim. No real sessions or message data were used.

Validation:

• Identical final fixture SHA-256 c8acac7866197ec32a669292e6ef07c06f3ddde57b6452bbf4b6f025c2971aa6: six regression checks fail on the unchanged merged base; all seven pass after correction.
• Coverage includes held completion after clear/delete and restart, duplicate delivery, chat/range isolation, edit/revoke unread recount, reaction replacement/removal, and existing live eligibility.
• cargo fmt --all -- --check
• cargo clippy -p oxidezap-chat-store --all-targets --all-features -j 2 -- -D warnings
• Chat-store Nextest: 397 passed, 1 skipped, two build jobs/test threads.
• Chat-store doctests: successful, 3 ignored examples.

Hosted CI completed successfully: CI (2,070 native tests passed, 13 skipped; one existing daemon launcher test reported leaky), all four release artifacts plus archive verification, and Pages. The initial Pages run was cancelled when superseded by the run triggered after the PR was externally marked ready for review. This PR was created as a draft; this task did not mark it ready, merge it, invoke deployment, post review replies, or resolve threads.

---

Summary by cubic

Fixes three review gaps in shared group history handling so deleted chats can't be restored and shared amendments keep correct read and author identities.

• Clear/delete-chat retires covered pending attachment envelopes in the same transaction, retaining dedup keys so post-restart completions or redeliveries can't revive them.
• Shared edits/revokes for missing targets insert read-backfill placeholders with no unread delta; existing live targets keep their original eligibility.
• Aggregated reaction keys are translated to the sharing account's perspective, so the sharer's later live replacement/removal addresses the same author.

Summary by CodeRabbit

• Bug Fixes
  • Clearing or deleting a chat now retires matching pending shared-history attachments while preserving duplicate detection.
  • Shared-history edits and revocations no longer incorrectly increase unread counts when creating placeholders.
  • Restored shared-history reactions now use the correct sender perspective, and invalid reaction keys are discarded.
  • Shared history is processed only when its pending attachment matches the expected message details.