fix(mobile): export authorization gate plus composer/draft exact mentions

[only21mil]

Summary

Wave 1 P05 mobile lane, two parts:

• UD-2 export authorization (feat(mobile): require device authentication for identity export block/buzz#5116 port): fresh local device auth mints short-lived (120s), single-use grants bound to community, identity, action, confirmed peer, and pairing transcript. The nsec publishes only after both SAS confirmation and a consumed grant; cancel/unavailable/expired/peer-mismatch all abort without sending. Grants die on logout, community switch, background, and pairing teardown. Settings keeps pubkey-only copy. Android moves to FlutterFragmentActivity with all fork notification/permission callbacks kept plus a framework-only DeviceAuthBridge (no new deps); iOS gains an LAContext device-owner channel and the Face ID usage string.
• Composer/draft remainder of d07457687 (fix(mobile): bind same-name mentions to exact selected identities block/buzz#7385) that P05b skipped: exact mention labels, composer resolution at send, draft mention_keys persistence with hydration/pruning, qualified-label rendering, adapted to the diverged fork composer. mention_bindings.dart taken byte-identical from P05b's frozen head as the shared compile base.

Related issue

N/A (wave-1 work package P05; upstream refs block#5116, block#7385, commit d07457687).

Testing

• flutter analyze: clean.
• Full mobile suite: 1902 tests green, including new export_authorization_test, export_platform_contract_test, extended pairing recovery tests, settings pubkey test, and upstream exact_mention_tests (14 scenarios).
• Kotlin/Swift reviewed but not compiled on this VM; native proof stays with P11/P12 device acceptance.