feat: encrypted-history prompt, incoming-call alerts, message edit, panic button (v1.7.0+11)

P1 key_restore_prompt: offer recovery-key restore right after login
P2 incoming calls: mount overlay in app.dart + detect MSC3401 call.member
   (Element X signalling) — calls were previously invisible
P3 message edit: editMessage/EditMessage + Edit dialog (reactions/delete
   were already wired)
P5 panic button: new feature/panic module — hold-to-send alert text +
   m.location to a configured room; alert sent before geolocation so a
   denied permission never blocks it

All verified end-to-end in headless Chromium against production build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/features/calls/data/matrixrtc_repository.dart

@@ -1,6 +1,9 @@
-// Version: 1.2.0 | Created: 2026-04-01 | Updated: 2026-04-02
+// Version: 1.3.0 | Created: 2026-04-01 | Updated: 2026-07-04
 // MatrixRTC repository — handles outgoing call invites and detects incoming
-// calls via m.call.invite events per MSC4143 (MatrixRTC spec).
+// calls. v1.3.0 adds MSC3401 call.member state-event detection: Element X
+// (and app2 itself) signals group calls with org.matrix.msc3401.call.member,
+// not legacy m.call.invite, so incoming calls from Element X were invisible.
+// Both paths now guard against stale events replayed during initial sync.
 //
 // Incoming calls are surfaced via the incomingCallStream so the
 // IncomingCallOverlay can react to them.
@@ -79,13 +82,39 @@ class MatrixRtcRepository {
     }, type: EventTypes.CallInvite);
   }
 
-  void _onEvent(EventUpdate update) {
-    if (update.type != EventUpdateType.timeline) return;
-    if (update.content['type'] != EventTypes.CallInvite) return;
+  /// MSC3401 MatrixRTC call membership state event (what Element X sends).
+  static const _kCallMemberEventType = 'org.matrix.msc3401.call.member';
 
+  /// Events older than this are sync replays, not live calls.
+  static const _maxEventAge = Duration(seconds: 90);
+
+  /// Membership keys we have already alerted on (roomId|sender|membership).
+  final Set<String> _seenMembershipKeys = {};
+
+  void _onEvent(EventUpdate update) {
+    final eventType = update.content['type'] as String?;
+    if (eventType == EventTypes.CallInvite &&
+        update.type == EventUpdateType.timeline) {
+      _onCallInvite(update);
+    } else if (eventType == _kCallMemberEventType &&
+        (update.type == EventUpdateType.timeline ||
+            update.type == EventUpdateType.state)) {
+      _onCallMember(update);
+    }
+  }
+
+  bool _isStale(EventUpdate update) {
+    final ts = update.content['origin_server_ts'] as int?;
+    if (ts == null) return true;
+    final age = DateTime.now().millisecondsSinceEpoch - ts;
+    return age > _maxEventAge.inMilliseconds;
+  }
+
+  /// Legacy 1:1 call invites (app2 → app2).
+  void _onCallInvite(EventUpdate update) {
     final senderId = update.content['sender'] as String?;
-    // Ignore our own invites.
-    if (senderId == _myUserId) return;
+    // Ignore our own invites and stale events replayed on initial sync.
+    if (senderId == _myUserId || _isStale(update)) return;
 
     final roomId = update.roomID;
     final content = update.content['content'] as Map<String, dynamic>?;
@@ -93,21 +122,66 @@ class MatrixRtcRepository {
 
     final callId = content['call_id'] as String?;
     if (callId == null) return;
+    if (!_seenMembershipKeys.add('$roomId|$senderId|$callId')) return;
 
-    final room = _client.getRoomById(roomId);
-    final senderProfile = room?.unsafeGetUserFromMemoryOrFallback(
-      senderId ?? '',
+    _emitIncomingCall(
+      roomId: roomId,
+      senderId: senderId ?? '',
+      callId: callId,
+      isVideo: content['offer'] != null,
     );
+  }
+
+  /// MSC3401 group-call membership: someone (e.g. Element X) joined a call.
+  void _onCallMember(EventUpdate update) {
+    final senderId = update.content['sender'] as String?;
+    if (senderId == null || senderId == _myUserId || _isStale(update)) return;
+
+    final content = update.content['content'] as Map<String, dynamic>?;
+    final memberships = content?['memberships'] as List<dynamic>?;
+    // Empty/cleared memberships means the caller hung up — nothing to show.
+    if (memberships == null || memberships.isEmpty) return;
+
+    final membership = memberships.first as Map<String, dynamic>;
+    if (membership['application'] != 'm.call') return;
+
+    final expiresTs = membership['expires_ts'] as int?;
+    if (expiresTs != null &&
+        expiresTs < DateTime.now().millisecondsSinceEpoch) {
+      return;
+    }
+
+    final membershipId =
+        (membership['membershipID'] ?? membership['call_id'] ?? '').toString();
+    final roomId = update.roomID;
+    if (!_seenMembershipKeys.add('$roomId|$senderId|$membershipId')) return;
+
+    _emitIncomingCall(
+      roomId: roomId,
+      senderId: senderId,
+      callId: membershipId.isEmpty ? 'matrixrtc' : membershipId,
+      isVideo: true,
+    );
+  }
+
+  void _emitIncomingCall({
+    required String roomId,
+    required String senderId,
+    required String callId,
+    required bool isVideo,
+  }) {
+    final room = _client.getRoomById(roomId);
+    final senderProfile = room?.unsafeGetUserFromMemoryOrFallback(senderId);
 
     _incomingCallController.add(
       IncomingCall(
         callId: callId,
         roomId: roomId,
-        callerId: senderId ?? '',
+        callerId: senderId,
         callerDisplayName:
-            senderProfile?.displayName ?? senderId?.matrixLocalpart ?? '',
+            senderProfile?.displayName ?? senderId.matrixLocalpart,
         callerAvatarUrl: resolveMxcUrl(_client, senderProfile?.avatarUrl),
-        isVideo: (content['offer'] != null),
+        isVideo: isVideo,
       ),
     );
   }