Fix mobile unread badges and read state sync

[wesbillman]

Summary

Fixes the mobile unread badge/read-state work so it is stable under real pairing and live subscription behavior.

• Adds mobile NIP-RS read-state support with local persistence, encrypted kind:30078 sync, live merge, publish debouncing, and graceful local fallback when the relay/token cannot support remote read-state writes.
• Wires mobile channel unread dots to read-state and marks channels read from the actual loaded channel timeline position.
• Makes mobile channel list updates subscribe per channel using #h, and tracks the full channel event surface so live lastMessageAt behavior matches reload behavior.
• Fixes the live-message regression where one relay event could match both the unread listener and the open-channel listener but be globally deduped before reaching both.
• Keeps the pairing fix scoped to credential validation client ownership, and includes users:write in newly minted mobile pairing tokens for remote read-state publish.

Root Cause

The unread work introduced overlapping live subscriptions: the channel list and the open channel could both receive the same relay event. Mobile relay-session dedupe was keyed only by event id, so whichever subscription flushed first suppressed delivery to the other subscription. That produced the observed state where the unread dot appeared but the open channel did not receive the message until reload.

Separately, mobile read-state publishing exercises NIP-RS kind:30078; stale relays or older paired tokens can reject that path even though normal desktop channel messaging works. Mobile now degrades to local read state for those permanent remote failures.

Validation

• Manual device test: pairing works; desktop-to-mobile live message/unread behavior works.
• Pre-commit hooks passed: desktop check, desktop Tauri fmt, mobile format/analyze, Rust fmt.
• Pre-push hooks passed: Rust fmt, desktop Tauri fmt, desktop check, mobile check, mobile test, desktop build, desktop Tauri check, Rust clippy, Rust unit tests.
• flutter test
• cargo test --manifest-path desktop/src-tauri/Cargo.toml mobile_pairing_token_includes_users_write_scope

Notes

No uncommitted sprout-relay code changes are included here. Runtime relay support for kind:30078 comes from the existing NIP-RS relay work in #420; this PR keeps the new work scoped to mobile behavior plus the desktop mobile-token scope needed for new pairings.