Feature/privacy settings

[SugeethJSA]

: Implement privacy settings management in the frontend

[celestix]

Required changes — release blocker

Reviewed head: 09ec2161b8e4e54e480372391fca80fefd986d9d.

• frontend/src/components/chat/MediaContent.tsx:235-334: 🔴 if (mediaSrc) { is never closed; frontend build and Vitest transformation fail with unexpected EOF. Close the block and add rendering/playback tests for every media branch.
• api/api.go:393-399: 🔴 Requests "sqlite" while mattn registers "sqlite3"; application startup fails. Restore "sqlite3" and add a startup smoke test.

frontend/src/components/chat/MessageItem.tsx:172-181,287 and api/message.go:854-865 create a security boundary failure: editing starts from rendered HTML, sends that HTML as plaintext, stores unescaped user input, and later renders it through dangerouslySetInnerHTML. This can execute injected markup in the privileged Wails frontend. Persist canonical raw text separately, escape/render it through one reviewed renderer, validate the edited message type, and emit the safely decoded update.

• api/message.go:573-670: 🔴 Forwarding reads rendered HTML rather than canonical typed content, so text sends literal markup and locations/polls/contacts become HTML text. Persist raw text/protobuf metadata and forward by actual message type.
• api/message.go:573-651: 🔴 Media forwarding loses filenames, dimensions, thumbnails, GIF/PTV flags, PTT duration/waveform, and forwarded context; view-once unwrapping becomes a privacy bypass. Preserve typed metadata, reject unsupported/view-once content, and mark forwarded context explicitly.
• api/message.go:575-582: 🟡 Buffers the full download/upload in memory without size, timeout, or concurrency limits. Use cancellable bounded streaming via existing whatsmeow DownloadToFile/UploadReader; no new dependency is needed.
• api/message.go:666-670: 🔴 Discards the send response and stores/emits no local echo. Route through the existing local-send path and return the sent ID/decoded DTO.
• frontend/src/components/chat/ForwardDialog.tsx:18,27, frontend/src/store/useMessageStore.ts:25-38: 🔴 setActiveChatId truncates the source cache but does not navigate because useChatStore.selectedChatId remains unchanged. Remove it or navigate via useChatStore.selectChat(targetChat).
• internal/query/message_media.go:58-62, internal/store/message.go:801-812: 🔴 UpdateMessageMediaByMessageID now expects 14 arguments but UpdateMessageContent supplies 11; media-caption edits fail at runtime. Pass PTT fields explicitly or update only mutable caption fields.
• internal/store/message.go:742-763,1594-1614: 🔴 PTT metadata is served only from an unbounded in-memory map and disappears after restart. Read the persisted columns in paged/single-message queries and remove the cache.
• frontend/src/components/chat/MediaContent.tsx:314-329: 🔴 PTT button has no handler/audio element and permanent zero progress. Drive a real audio element and bind playback time/progress/waveform.
• internal/query/message_media.go:4-38: 🔴 Fresh schema omits PTT columns and the multi-statement migration can stop after one duplicate column. Include columns in the create schema and version/introspect each migration separately.
• api/message.go:869-928, internal/store/message.go:1969-1985: 🔴 Edit/revoke/delete/clear report success after persistence failures, leave the open list stale, and orphan media/previews/pins/caches; ClearChat queries nonexistent chat_list after destructive autocommit. Use one chat-scoped runSync transaction, check RowsAffected, clean dependents/cache, and emit typed update/delete events.
• api/message.go:893-914, frontend/src/components/chat/ChatInput.tsx:599-610: 🔴 Location accepts non-finite/out-of-range/trailing-junk coordinates, logs exact GPS/JID, and creates no local echo. Strictly parse finite latitude/longitude ranges, redact logs, and use sendAndStoreLocal.
• privacy API: 🔴 Casts arbitrary strings and swallows read errors. Use typed per-setting enums, backend validation, and propagate errors.
• group photo API: 🔴 Bound method returns not implemented while UI exposes it. Remove the UI/API until implemented or complete it with size/MIME validation and tests.
• tests: 🔴 No tests were added for approximately 1,900 new lines. Add raw-text/HTML-injection, typed forward, view-once rejection, media metadata, PTT restart/migration, edit/revoke/delete/clear transactions, location validation, privacy contract, frontend interaction, strict tsc -b, and production Wails build tests.

Go package tests passing is insufficient here: they do not exercise application startup, SQL statement arity, Wails bindings, or any of the new user-facing paths.