feat(settings): add Screen Privacy toggle

[wired-pasteque]

Adds a user-controllable Screen Privacy toggle (in app settings) that turns OS-level screenshot/recording blocking on sensitive screens (recovery phrase, seed views) on or off. Defaults on, so existing installs keep protection until they opt out.

Also, fixed a bug where leaving a protected screen could leave screenshots blocked across the entire app.

Screen_Recording_20260819_170352.mp4

[wired-pasteque]

@claude, check the fixes

[claude]

Claude finished @wired-pasteque's task in 4m 34s —— View job

---

Review: fixes check out ✅

• Read repo guidelines (no CLAUDE.md in repo)
• Diff PR against origin/develop
• Review screen-capture protection lifecycle (the "stuck blocked" bug fix)
• Review settings/DB migration changes (v14 → v15)
• Review tests
• Post review findings

The "stuck protection" bug fix is correct

The old code in AllSeedViewScreen called enableScreenPrivacy() in build and only disabled it via PopScope.onPopInvokedWithResult, so any non-pop navigation left the whole app blocked. The fix addresses this at both layers:

• lib/features/all_seed_view/ui/all_seed_view_screen.dart is now a StatefulWidget that acquires in initState and releases in dispose — dispose fires on any route removal, not just pop.
• lib/core/utils/screen_capture_protection.dart reference-counts mounted protected screens, which correctly handles overlapping screens (push replacement where the new screen's initState runs before the old screen's dispose no longer flickers or drops protection). _sync() computes the desired state synchronously before the platform call, so the last invocation always wins.
• The _privacyAcquired guard in lib/core/mixins/privacy_screen.dart makes acquire/release idempotent per screen, so the count can't be corrupted by double calls.
• All 7 users of PrivacyScreen now follow the acquire-in-initState/late final, release-in-dispose pattern — I checked each one.

The toggle plumbing is also sound: SettingsCubit is app-scoped and init() runs at startup (lib/main.dart:270), so the persisted preference reaches the singleton before any sensitive screen can mount, and the default is fail-safe (true) until then. toggleScreenCaptureProtection applies the change immediately to already-mounted screens. Tests in test/core_test/screen_capture_protection_test.dart cover the ref-counting, opt-out-while-mounted, and opt-back-in paths.

One thing to flag before merge

Dev installs already on schema v15 won't get the new column. On develop, Schema14To15 previously existed (it added only the Tor columns), so any internal/dev device that already upgraded to v15 will never re-run the 14→15 step — screen_capture_protection_enabled will be missing from their settings table and settings reads will fail at runtime. The PR handles the analogous problem for released v14 devices (the idempotency guard + the new test), but not this one. Since v15 is unreleased this may be acceptable ("dev devices reinstall"), but it should be a conscious decision — alternatives are bumping to v16 for the new column, or guarding the settings read. Please confirm this is intended.

Minor notes (non-blocking)

• toggleScreenCaptureProtection (settings_cubit.dart:223): if storedSettings is somehow still null, the DB and singleton get updated but copyWith on null leaves state unchanged, so the switch would visually snap back to "on" while protection is actually off. Practically unreachable given init() runs at startup, but an early-return or reload would make it airtight.
• Import ordering in settings_cubit.dart (screen_capture_protection.dart before result.dart) and settings_locator.dart (set_screen_capture... before set_payjoin...) isn't alphabetical — not lint-enforced here (package:lints/recommended doesn't include directives_ordering), so purely cosmetic.
• The Podfile change disables CocoaPods' static-transitive-dependency check globally rather than per-pod; the in-code comment already documents this trade-off, so just noting it's a known blind spot for future dependencies.

What I verified

Migration consistency (v14 JSON/generated schema no longer carry the Tor columns; v15 carries Tor + screen-capture; both migration tests exercise the released-v14 and dev-device-with-tor-columns paths), the seed row default, all .arb files carry both new keys, the private-named-parameter constructor style matches the repo (Dart 3.12), and the cubit test wiring. I could not run flutter analyze or the test suite — no Flutter toolchain is available in this environment, so please rely on CI for that.