fix: red-team round 3 hardening across desktop, mobile, core and server

Batch of red-team r3 fixes that were in the working tree before the
2026-09-28 design overhaul, committed as one unit with their tests.

- desktop main: STT timeouts and sidecar, voice recording store, sync
  (credentials, audio, knowledge reindex, push gates), runtime
  provisioner, update policy, AltGr keybindings, voice-command policy,
  dictionary file codec/limits, meeting transcript condensing and a
  local recording ledger so interrupted-session recovery only closes
  meetings this device recorded (a phone's live meeting is left alone).
- mobile: login CSRF via implicit token callbacks rejected, account
  deletion/retention, durable queue retention, knowledge realtime
  without unfiltered DELETE, meeting re-record failure paths, cloud STT
  client, preferences store/resync.
- core: text chunking splits long unbroken transcripts to fit, template
  field policy, dictionary limits, meeting markdown inline handling.
- server: payple webhook policy and cancellation order scope, meeting
  document generation quota, team RPC null-role guard, unified LLM
  quota in-flight accounting, knowledge chunk vector index, meeting
  re-record failure paths (migrations 20260929*).
- ci: portable/runtime feed gates, update-policy schema, Forgejo file
  delete and alias planning.

Four older tests are updated to the new contracts rather than the old
behavior: token-pair auth callbacks are rejected, knowledge realtime no
longer subscribes to DELETE, long transcript lines are split, and
meeting recovery requires the local recording ledger for empty rows.

apps/mobile-rn/src/features/knowledge/knowledge-service.ts

@@ -7,6 +7,11 @@ import type {
 import { SUPABASE_URL } from '@d3ro/core/supabase-config'
 import { supabase } from '../../lib/supabase'
 import { createUuidV4 } from '../../lib/random-id'
+import {
+  type ForegroundReconciliationDeps,
+  knowledgeRealtimeBindings,
+  startForegroundReconciliation,
+} from './knowledge-realtime'
 
 export type MobileKnowledgeFileType = Extract<KnowledgeFileType, 'txt' | 'md'>
 
@@ -607,31 +612,40 @@ export async function searchKnowledge(
   }
 }
 
+export interface KnowledgeDocumentSubscriptionOptions {
+  /**
+   * Owner whose documents the list shows. When given, INSERT/UPDATE events are
+   * narrowed to that owner so teammates' shared-document writes do not trigger
+   * list refetches for a list that only shows owned documents.
+   */
+  userId?: string
+  /** Injectable foreground/interval ports for deletion reconciliation. */
+  reconciliation?: ForegroundReconciliationDeps
+}
+
+/**
+ * Live updates for the Knowledge list. Only INSERT/UPDATE are subscribed:
+ * Postgres Changes cannot filter DELETE events and does not apply RLS to them,
+ * so a DELETE subscription would leak other accounts' document ids and fan out
+ * a refetch to every client on every deletion. Deletions are reconciled by
+ * foreground polling instead (same policy as use-history-sync.ts).
+ */
 export function subscribeToKnowledgeDocuments(
   onChanged: () => void,
   onStatus: (connected: boolean) => void,
+  options: KnowledgeDocumentSubscriptionOptions = {},
 ): KnowledgeDocumentSubscription {
-  const channel: RealtimeChannel = supabase
-    .channel(`mobile-knowledge-${createUuidV4()}`)
-    .on('postgres_changes', {
-      event: 'INSERT',
-      schema: 'public',
-      table: 'knowledge_documents',
-    }, onChanged)
-    .on('postgres_changes', {
-      event: 'UPDATE',
-      schema: 'public',
-      table: 'knowledge_documents',
-    }, onChanged)
-    .on('postgres_changes', {
-      event: 'DELETE',
-      schema: 'public',
-      table: 'knowledge_documents',
-    }, onChanged)
-    .subscribe((status) => onStatus(status === 'SUBSCRIBED'))
+  if (options.userId !== undefined) requireUuid(options.userId, 'knowledge owner id')
+  let channel: RealtimeChannel = supabase.channel(`mobile-knowledge-${createUuidV4()}`)
+  for (const binding of knowledgeRealtimeBindings(options.userId)) {
+    channel = channel.on('postgres_changes', binding, onChanged)
+  }
+  channel = channel.subscribe((status) => onStatus(status === 'SUBSCRIBED'))
+  const reconciliation = startForegroundReconciliation(onChanged, options.reconciliation)
 
   return {
     unsubscribe: async () => {
+      reconciliation.stop()
       await supabase.removeChannel(channel)
     },
   }