fix(blobs): re-mint expired download URLs before loading them

[bmc08gt]

Profile photos showed the grey placeholder in the chat header and on the user profile screen while the same photo still rendered in the chats list. The chats list had just been refreshed from GetDmChatFeed; the other two surfaces read a profile persisted earlier, whose CloudFront download URL — signed for about 15 minutes — had long since expired. Coil draws the error drawable on a failed load, not the placeholder, so what looked like "no photo" was a 403.

What changed

Expiry is modelled and persisted. BlobMetadata carries download_url.expires_at as expiresAtMillis through the proto mapping and into the persisted JSON. Every other field on it is intrinsic to the immutable bytes; this one is not, and dropping it left a stored copy with no way to know its URL was dead. Metadata with no expiry is treated as usable, so already-persisted rows don't force a re-resolve on every load.

MediaUrlResolver re-mints before the URL reaches Coil. A singleton that checks the rendition's expiry, calls GetBlobs for a fresh URL, and memoises the result for the process, so several surfaces showing the same avatar re-mint once between them. rememberMediaUrl wires it into composition: a load that fails anyway gets one further re-mint from Coil's error callback, and only a second failure falls back.

BlobAccessContext carries the authorization scope. Re-minting a blob the caller doesn't own needs GetBlobsRequest.context naming the surface that authorizes the read — a profile id for another user's avatar, a chat id for chat media. Without it the server omits those ids from the response rather than failing, which is indistinguishable from a blob that isn't ready. The scope is a required parameter on ContactAvatar's MediaItem overload, so every call site has to state which one it is.

The chat member → UserProfile mapping dropped the user id. The server sets the id on the chat member and not again inside the nested profile, so userId came out null and callers had nothing to name the profile with. Fixed in both mapping paths — toChatMetadata() and the injected ChatMetadataMapper — each with a test that fails when the fallback is removed.

BlurHash instead of the grey glyph. Avatars decode the BlurHash once and use it as both Coil's placeholder and its error drawable, so a re-mint in flight, or a load that fails outright, shows the blurred photo rather than the person icon.

Cache keys are the blob id, not the URL. download_url is minted per fetch, so a URL-keyed cache misses every time even when the bytes are held. Requests key memory and disk on the base58 blob id; notification avatars use the same key and now go through the resolver too.

Notes

• BlobStorageApi validates the request before attaching the context. dev.bmcreations:protovalidate 0.1.1 generates an AccessContext validator that emits checkRequired(scopeCase == CHAT, "chat") and checkRequired(scopeCase == PROFILE, "profile") unconditionally, so no oneof arm can validate. The comment at the split says to drop it once the generator handles oneof members.
• MediaUrlResolver is reset on sign-out — download URLs are minted for the signed-in owner.
• Wallet token icons still show ic_placeholder_user. They load a plain token.imageUrl string through TokenIcon, a different pipeline this branch doesn't touch.