Feature: Encrypt private media before BLE fragmentation

Summary

Port iOS behavior: encrypt the complete private BitchatFilePacket before BLE fragmentation, using the canonical cross-platform Noise inner type.

Upstream (iOS)

• https://github.com/permissionlesstech/bitchat/pull/1434 — Encrypt private media before BLE fragmentation
• Delivery receipts follow-up: https://github.com/permissionlesstech/bitchat/pull/1466

What it is

• Encrypt entire private file payload first, then fragment ciphertext over BLE
• Canonical Noise inner type 0x20 for private file transfer
• Accept legacy/prerelease iOS inner type 0x09 on receive only
• Authenticated peer-state inner type 0x21 (versioned capability TLVs + peer Ed25519 key inside Noise)
• Signed public capability bit is discovery only; does not pin encrypted-media policy

Why Android needs it

Security + interop: mixed Android/iOS private images/voice notes must agree on encrypt-then-fragment and inner types, or transfers fail or weaken confidentiality at the fragment layer.

Acceptance criteria

• Private media: encrypt-then-fragment (not fragment-then-encrypt per chunk)
• Send 0x20; accept 0x20 and legacy 0x09 on receive
• Peer-state 0x21 if required for media capability selection
• Interop with iOS private image/voice note send/receive
• Delivery receipt behavior compatible with #1466 where applicable

Priority

High — security-sensitive media path + existing cross-platform file transfer pain.