…ract changes

Reflect the current Chat API and Chat XDK surface:

- conversation-key setup now uses prepare_conversation_key_change
  (one call: fresh key + participant wraps + signed action signature);
  the keys endpoint adds or rotates keys and returns the canonical
  conversation_id alongside sequence_id
- group creation uses prepare_group_create and member adds use
  prepare_group_members_change; both return two action signatures and
  the docs show sending both
- action signatures are required and validated at the API boundary
  (400 problem-details on malformed input); group endpoints return
  stable human-readable error messages
- public-key responses name the version field public_key_version;
  every fields list and sample read updated
- removed dropped SDK methods (prepare_conversation_keys,
  sign_add_members, sign_key_change,
  encrypt_conversation_key_for_recipients) and renamed
  PreparedConversationKeys to PreparedConversationChange
- documented conversation-id form flexibility (colon, hyphen, or bare
  recipient id all sign identically; URL paths still use hyphens),
  permanent verification failures, and chunked stream encryption

- teach verify_key_binding before wrapping conversation keys (warnings
  in Getting Started and the XDK reference, step in Groups)
- state the group title/avatar verbatim-match rule: values passed to
  prepare_group_create are signed and embedded exactly as given, so the
  POST body must carry byte-identical group_name/group_avatar_url; the
  encrypted-metadata section explains why a create-time title cannot be
  ciphertext under the group's own key
- point group flows at the batch public-keys route
- add rotation semantics: fresh keys on member adds mean new members
  cannot read earlier versions, rotation never revokes old versions,
  and rotating after suspected exposure protects future messages only
- primer: new 'Signed state changes (action signatures)' section
  covering what is signed, why the server validates structurally, and
  where cryptographic verification happens
- fix encrypt_reply samples to the real positional signatures and
  encrypt_message optional-argument names
- replace every ellipsis with explicit paths, field lists, example
  values, or complete code

Fix API-accuracy bugs against the current SDK: streaming is a two-arg
raw-bytes call (media_hash_key comes from upload finalize, not
encrypt_stream); prepare methods take a single params object/struct in
every binding except Python (and the params types dropped the Prepare
prefix); decrypt_events .errors is a map, not a list; Go conversation
keys are raw bytes, not base64; verification is fail-closed by default.
Add the incremental streaming API, the keyVersion-per-event media key
selection contract, the three Juicebox config shapes, and the hex
utility helpers.

Address code-review findings on the API-accuracy pass: TypeScript
encrypt_message/encrypt_reply/reactions take a single params object;
Go import_keys takes raw bytes (decode the base64 env var first); Go
utility calls honor their (value, error) arities; Java reads the public
conversationKey field, not a getter; C#/Java/Rust image-dimension and
conversation-key types match the SDK; width/height casts added where
narrowing.

State the conversation key as plain raw bytes without phrasing that
implies a prior encoding, and remove code comments that only restate a
variable's type.

docs(xchat): correct chat-xdk SDK API surface across guides