fix: pending-approval refresh + banner notifications + UI bundle

[DocNR]

Summary

Bundle of fixes targeting build 25 / TestFlight. Two themes:

1. L1 pending-approval refresh + banner regression (the main one)

Pre-L1, every sign request reached Clave via APNs → NSE, and NSE was the sole producer of "Approve Signing Request" banners. Post-L1 (PR #11), when Clave is foregrounded or in the 2s .inactive grace window, L1 catches kind:24133 events directly via WebSocket and SharedStorage.markEventProcessed marks the event id. NSE then runs from the same APNs push, sees the dedupe, returns .noEvents, and produces a silent passive notification — correct, since L1 already handled it. But L1 itself never produced a user-facing signal:

• SharedStorage.queuePendingRequest writes to UserDefaults but didn't broadcast a refresh signal, so the @Observable AppState.pendingRequests stayed stale until HomeView.onAppear (tab switch).
• L1 didn't schedule any local notification when it queued a pending request.

Refresh fix:

• SharedStorage.queuePendingRequest / removePendingRequest / clearPendingRequests post .pendingRequestsUpdated.
• AppState observes it in init and calls refreshPendingRequests() on main.
• MainTabView also refreshes on scenePhase .active so cross-process NSE writes get picked up on app foreground (the in-process NotificationCenter post doesn't cross the NSE↔main-app boundary).

Banner fix:

• New Shared/PendingApprovalBanner.swift: `schedule(requestId:clientPubkey:eventKind:)` + `clear(requestId:)`. Identifier `pending-approval-`.
• `LightSigner.RequestResult` gains `pendingRequestId: String?`.
• `ForegroundRelaySubscription` schedules a banner when L1 catches a request needing approval. `ClaveApp` foreground push handler also schedules (defensive — covers the rare case where NSE didn't process and main-app marked the event first).
• `AppState.approvePendingRequest` / `denyPendingRequest` call `PendingApprovalBanner.clear`.
• `ClaveApp.willPresent` distinguishes locally-scheduled banners (display directly), APNs with NSE-set non-empty title (display — was being suppressed by unconditional `completionHandler([])`), and APNs with empty title (suppress, NSE silent-success case).

NSE's own `deliverContent .pending` path is unchanged — still produces a banner via `contentHandler` for the pure-background case. The dedupe ensures only one of {NSE banner, L1-scheduled banner, foreground-handler-scheduled banner} actually fires per event.

2. UI/UX bundle (additional commit `3401c09`)

• Pending approvals card edge padding: added `.padding(.horizontal)` after `.background` so the orange-bordered card stops touching screen edges. Pre-existing since v1.0 UX sprint, not L1-caused, only surfaced once pending approvals started rendering reliably.
• Snapshot protection (audit A10.1): new `SnapshotProtected.swift` ViewModifier overlays an opaque privacy view when scenePhase ≠ `.active`. Applied to `ExportKeySheet`, `ConnectSheet`, `QRCodeView`, `ApprovalSheet`. iOS captures the app-switcher snapshot during `.inactive`, so per-sheet overlays prevent leaking nsec / bunker secret / QR / incoming approval into the snapshot.
• AvatarView name initials: gains optional `name: String?`. When set, shows up to two letters from the name (e.g. "Joe Bloggs" → "JB"; "Yakihonne" → "YA") in proportional font. Pubkey-prefix fallback unchanged. Gradient stays pubkey-derived so renames don't change avatar color. Updated four call sites.
• ClientDetailView UX rework:
  • Tap client name (or pencil affordance) in header → existing rename alert. Bottom Rename button removed.
  • New toolbar overflow menu (`ellipsis.circle`, top-right): Connection Info, Rename, Unpair Client. Unpair was previously buried below the recent-activity list.
  • New `ConnectionInfoSheet`: name, origin URL, npub + hex pubkey (both copyable), trust level, first-connected/last-seen timestamps, total request count, paired relay set.

Test plan

• `xcodebuild -scheme Clave -destination 'generic/platform=iOS' build` → BUILD SUCCEEDED
• `xcodebuild test` on iPhone 17 Pro Max sim (iOS 26.4) → TEST SUCCEEDED
• Device test (build 25 TestFlight) — scenarios:
  • Foregrounded Clave + sign request needing approval → banner pops within 1s, pending row appears immediately (no tab switch needed).
  • Backgrounded Clave + sign request → NSE banner pops; opening Clave shows pending row regardless of starting tab.
  • Brief `.inactive` (control-center swipe) + sign → exactly one banner.
  • Approve/Deny → banner clears from Notification Center; pending row disappears.
  • Full-trust client signing → still silent (no regression).
  • App-switcher: pull up app switcher with ExportKeySheet / ConnectSheet / QRCodeView / ApprovalSheet open → snapshot shows lock-shield overlay, not the sensitive content.
  • Rename a client; verify avatar initials update from pubkey prefix to name initials in HomeView client row, ClientDetailView header, and ApprovalSheet header.
  • ClientDetailView toolbar Menu: Connection Info shows correct values; Rename works; Unpair confirms then dismisses.

🤖 Generated with Claude Code