fix(apps): preserve focus and permission sessions

[QuickMythril]

Summary

This is a Home 2.0.0 prerelease blocker fix for desktop focus theft, repeated app-permission prompts, locked-send retry, Android route instability, and automatic Qortium private-group key bootstrap observed during Chat acceptance.

• keep the active native QDN view mounted across routine node telemetry refreshes, while delivering route/capability state through a separate bridge-state update
• focus the Home renderer after hiding an app view only while the Home window still owns OS focus
• show Checking Qortium… or Checking Qortal… while a restored tab's first node check is pending instead of briefly reporting the chain unavailable
• refuse missing permissions from hidden tabs without activating the tab or raising trusted Home chrome, and coalesce concurrent requests for the same grant
• provide one clearly disclosed, tab-scoped read-only account approval covering the selected Home account on both chains, including identity, DMs, private groups/searches and attachments, and that app's pending transaction records
• preserve that read approval across lock/unlock, node failover, and same-app navigation; revoke it on a real account change, tab close, cross-app/resource change, or Home restart
• let one explicitly disclosed chat mutation grant cover send/edit/delete/reaction within the same public group, direct peer, or private group
• await delivery of updated account state to the app view before unlock completes, allowing Chat's held operation to resume without another Send click
• expose account-relative Qortium private-group keyAvailable state on desktop and Android, distinct from Core's protocol-level available flag
• when a Qortium message/edit/delete/reaction finds no current key, automatically create and wrap a key for every current member, broadcast the independent announcement, cache it, and continue the original mutation in the same approved app action
• keep Qortium key management out of normal user/admin UX; Qortal's separate named QDN bundle lifecycle remains unchanged
• if the announcement broadcast is uncertain, retain its signature with stage: "key-announcement", prove messageSubmitted: false, do not cache the key, and allow the original message to be retried safely
• make Android Home 2's portable node selection authoritative through chat/private/group signing instead of performing a second legacy route lookup or grafting a legacy API key
• retain a recently verified Android public route through one brief failed probe cycle, preventing false unavailable transitions between successful checks
• keep private QPGC state/member/epoch validation inside the dedicated private vault rather than sending Home's own /chat/private/... call through the generic app read allowlist
• permit only Home's same-origin MemoryPoW worker in the Android renderer CSP
• give every CHAT/attachment/QPGC mutation the Android bridge's 330-second long-action window so a hosted app does not time out while Home may still compute and broadcast
• retain all resource identity, membership, reference, ownership, signing, route, journal, and rate-limit checks

Companion Chat PR QortiumDev/qortium-chat#101 removes the mistaken manual Qortium recovery UI, handles key-setup-only uncertainty as safe to retry, reconciles its journal entry once a usable key is observed, and adds group ID labels. Older Chat builds ignore the added state and result fields.

Verification

• npm test — 117/117 test scripts passed, including the full 64-trial MemoryPoW differential/known-answer run
• npm run build — renderer and Electron type/build checks passed
• Android bridge unit tests and Home 2 foundation/node-client regressions passed
• current Core ChatResourceTests#testPrivateGroupSendAndDecrypt passed and confirms Core's automatic first-send lifecycle
• npm run dist:linux:x64 from the earlier PR head — hardened AppImage check passed with 23,628 ASAR entries
• npm run smoke:desktop:home-v2-nodes — packaged AppImage passed against local Qortium, public Qortium, and public Qortal
• npm run smoke:desktop:widgets — complete native widget flow passed
• desktop AppImage live acceptance passed: one combined account-read approval, no focus theft, automatic group-4 key announcement, held private message sent, decrypted history survived reload
• Android 13 WTATTRW2 live acceptance passed on the signed release APK:
  • restored Chat showed Checking Qortium… while the initial check was pending, not a false unavailable state
  • retained group-4 QPGC history decrypted normally
  • AndroidTimeoutFix0017 remained Sending… for roughly 54 seconds, then rendered normally with Reply/React/Edit/Delete; node1 and node2 independently confirmed signature 5sDmPa2Er8TLt4BmDsiXFvhzNQ2jFnXVd3wHhg3RoJwojBc1usaxYSfWZTY2jMqXZmyg5U4UuDn5g2orYNtiUg5y, with no matching unconfirmed transaction
  • AndroidPublicFix0020 rendered normally in General Chat; both nodes confirmed exact payload and signature 26aX76vHjkN5BJHJaK8S1r9kH93c2tFTjARt2RDBAvVCNPSrkvy6Aoo7whiuErra4QALkV29w4x7APHg1xbzpHDe, with no matching unconfirmed transaction

Final local signed APK from 03acdc9:

• path: dist-release/Qortium-Home-2.0.0-android-release.apk
• SHA-256: 47c9109cd221ddac09b55f80b363ca06bb528fa556afd0dd2f7434f33ac22523
• certificate SHA-256: 5b7b85b93e2d1955eacde68b51cc8d51b06fa65102e30c150885ebaa3c43eb8f
• installed in place as 2.0.0/code 38; accounts preserved; production WebView debugging disabled; launch/unlock smoke passed

The local artifacts are acceptance evidence only. The existing prerelease draft and its assets have not been changed.

Remaining companion-app acceptance

Home behavior in this PR is accepted on desktop and Android. Chat #101 still needs two companion fixes before release acceptance is complete:

1. consume the first successful combined account-read result immediately instead of requiring a second Use selected account click;
2. do not attempt WebSockets against Android Home 2's synthetic *.qdn.androidplatform.net frame origin, which cannot resolve; use the existing bounded HTTP polling path there.

After those Chat fixes land, repeat a cold-start account-read/private-history smoke in the final non-debuggable APK before merging and rebuilding prerelease artifacts.