fix(migration): chunked 0x03 GCM format to fix export OOM

[torlando-tech]

Summary

Fixes the OOM crash in the Android data-export/import path by replacing the
single-shot GCM format with a chunked 0x03 variant and by streaming the
importer off an on-disk staged file instead of an in-memory zipBytes.

• Crypto (new 0x03 format): 8 MiB max chunks, per-chunk counter IVs
  (baseIv + chunk index), streamEncrypt/decryptStream read and write
  chunk-by-chunk so peak memory is bounded to ~2x chunk size regardless of
  bundle size. Legacy 0x02 bundles still decrypt (importer is dual-version).
• Importer: importData now stages the bundle to a local plaintext ZIP
  under cacheDir/migration_import (reusing the preview's staged file when
  present), parses the manifest in a single streaming decodeFromStream
  pass, and streams attachments from the staged file. PreviewWithData
  carries a File, not a ByteArray. Staged-file ownership is explicit:
  the importer deletes files it created; the ViewModel deletes the preview's
  file; cleanupStagedImports() clears leftovers at ViewModel init.
• Exporter: unchanged API surface (already routed through
  MigrationCrypto.encryptFile); now emits 0x03.

The previously-OOMing case (120 MiB export decrypting under a 90 MiB heap)
now passes.

Scope: Option A only. The export path still materializes the full
MigrationBundle in RAM before encryption (streaming export / ratchets-as-ZIP-entries
is a tracked follow-up, Option C).

Rebase note

Rebased onto current main, which landed call-history migration work
(760734d5) that touched the same importer/exporter/data regions this PR
rewrites. Adapted to the new API:

• MigrationImporter.importDataInternal version-8 guard: plain return
  instead of the old return@withContext label (no withContext scope left).
• MigrationCallHistoryImportTest: cachedZipBytes = zip(...) call sites
  migrated to cachedZipFile = tempZipFile(zip(...)) via a new helper that
  writes the ZIP to a temp file (matching the file-based import contract).

Verification (exact head)

• :app:compileSentryKotlinBackendDebug{Kotlin,UnitTestKotlin} - clean
• :app:ktlintCheck + :app:detekt - clean
• :app:testSentryKotlinBackendDebugUnitTest for migration.* +
  MigrationViewModelTest - all pass (crypto 19 incl. 3 legacy 0x02 tests,
  importer-encryption 8, viewmodel 20, call-history import suite green)
• 120 MiB export decrypt under a 90 MiB heap: passes

Files

• migration/MigrationCrypto.kt - 0x03 chunked-GCM + 0x02 legacy, streaming
• migration/MigrationData.kt - PreviewWithData holds File
• migration/MigrationImporter.kt - staging, streaming, cleanup, API rename
• viewmodel/MigrationViewModel.kt - cachedImportFile, init cleanup
• test/.../MigrationCallHistoryImportTest.kt - adapted to cachedZipFile
• test/.../MigrationCryptoTest.kt - +3 legacy 0x02 compat tests
• test/.../MigrationViewModelTest.kt - PreviewWithData(File) stubs

[greptile-apps]

Greptile Summary

The PR replaces whole-file migration encryption and import buffering with authenticated, chunked AES-GCM and disk-backed streaming.

• Adds the authenticated 0x03 chunk format while retaining 0x02 import compatibility.
• Stages imports in cache, streams manifest and attachment processing, and defines staged-file ownership and cleanup.
• Tracks preview jobs and sequence IDs to prevent stale preview results and password prompts.
• Adds crypto compatibility, framing-integrity, large-payload, importer, and ViewModel regression coverage.

Confidence Score: 5/5

The PR appears safe to merge; the previous findings are resolved and the latest sequence guard closes the stale password-prompt race.

No new actionable issue remains. Current code authenticates chunk framing, handles large-length arithmetic safely, rejects invalid zero-sized chunks, removes failed or superseded staged files, and prevents stale preview checks from updating current state. All previous root threads were manually resolved.

Important Files Changed

Filename	Overview
app/src/main/java/network/columba/app/migration/MigrationCrypto.kt	Implements authenticated chunked 0x03 encryption and bounded-memory decryption while preserving legacy 0x02 support.
app/src/main/java/network/columba/app/migration/MigrationImporter.kt	Replaces in-memory bundles with staged files, streaming manifest and attachment reads, and explicit failure cleanup.
app/src/main/java/network/columba/app/viewmodel/MigrationViewModel.kt	Manages staged-file ownership and prevents superseded preview jobs or encryption checks from updating current state.
app/src/main/java/network/columba/app/migration/MigrationData.kt	Changes preview payload ownership from a ByteArray to a staged File.
app/src/test/java/network/columba/app/migration/MigrationCryptoTest.kt	Adds legacy compatibility and authenticated-framing regression tests.
app/src/test/java/network/columba/app/migration/MigrationCallHistoryImportTest.kt	Adapts call-history import coverage to the staged-file API.
app/src/test/java/network/columba/app/viewmodel/MigrationViewModelTest.kt	Updates preview fixtures and initialization stubs for file-backed imports and cleanup.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  ExportZip[Plaintext export ZIP] --> ChunkEncrypt[Chunked AES-GCM encryption]
  ChunkEncrypt --> Encrypted03[Encrypted 0x03 bundle]
  Encrypted03 --> Stage[Stage bundle in cache]
  Legacy02[Legacy 0x02 bundle] --> Stage
  Stage --> Decrypt[Version-aware decryption]
  Decrypt --> StagedZip[Staged plaintext ZIP]
  StagedZip --> Manifest[Stream manifest]
  StagedZip --> Attachments[Stream attachments]
  Manifest --> Import[Import application data]
  Attachments --> Import
  Import --> Cleanup[Delete owned staged file]

Loading

_{Reviews (3): Last reviewed commit: "fix(migration): sequence-guard stale enc..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!