fix(shared): legacy conv-key migration query used .eq(null) instead of .is(null)

PostgREST translates .eq('col', null) to `col = NULL` which is always false
in SQL. The migration silently returned zero rows -> setupNewUserIdentity
fired but re-wrapped nothing -> users could set a PIN but every send threw
'Awaiting key'. Switching to .is('col', null) emits `col IS NULL` and the
migration finally finds its work.

Also makes the migration trigger idempotent and re-fires it on:
  - every successful loadOrUnlockUserKey
  - AuthContext startup when the user-key is already cached
so users stuck on 0.18.0 auto-recover the moment they install 0.18.1.

PinInput: focused + active-slot now show a brand-coloured ring, glow, and
a blinking caret so users see where the next keystroke lands.

apps/desktop/src/context/AuthContext.tsx

@@ -22,7 +22,7 @@ import { useTranslation } from 'react-i18next';
 import { ensureInstallId } from '../lib/installId';
 import { setSecretStoreUser } from '../lib/secretStore';
 import { supabase } from '../lib/supabase';
-import { cachedUserKey } from '../lib/userIdentity';
+import { cachedUserKey, ensureLegacyMigrated } from '../lib/userIdentity';
 import { registerWebPush } from '../lib/webPush';
 
 // Discriminated union describing the per-user encrypted key blob lifecycle:
@@ -137,6 +137,12 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     const cached = await cachedUserKey(session.user.id);
     if (cached) {
       setUserKeyState({ status: 'unlocked' });
+      // Best-effort: re-wrap any unmigrated legacy bundles. Idempotent (RPC
+      // uses ON CONFLICT DO NOTHING). Recovers users who set up under 0.18.0
+      // where the migration query had a `.eq(null)` bug that made it a no-op.
+      void ensureLegacyMigrated(session.user.id).catch((err) => {
+        console.warn('legacy conv-key migration on auth-resume failed', err);
+      });
       return;
     }
     const blob = await fetchUserKeyBlob(supabase, session.user.id);