Feature: Require review before importing shared content

Summary

Port iOS share-import review gate: do not auto-send or blindly inject shared content; require explicit user confirmation.

Upstream (iOS)

• https://github.com/permissionlesstech/bitchat/pull/1430 — Require review before importing shared content

What it is

• Replace short-lived auto-send share handoff with one validated, 24-hour, single-slot pending envelope
• Show destination (mesh / geohash / private) + bounded content preview
• Explicit confirm copies into composer; sending remains a separate action
• Reject malformed, oversized, control-character, expired, and non-HTTP(S) URL payloads
• Clear pending on consume, cancel, panic wipe, and expiry

Why Android needs it

Android share targets / intent handlers should match this safer model so shared URLs/text cannot be surprise-sent into mesh or DMs.

Acceptance criteria

• Share/import always shows review UI before composer injection
• Validation + 24h single-slot retention parity
• No auto-send on import
• Cleared on panic wipe / expiry / cancel
• Document retention behavior

Priority

Medium — security/UX hygiene for share sheet.