fix(shared): legacy conv-key migration query used .eq(null) instead of .is(null)

PostgREST translates .eq('col', null) to `col = NULL` which is always false
in SQL. The migration silently returned zero rows -> setupNewUserIdentity
fired but re-wrapped nothing -> users could set a PIN but every send threw
'Awaiting key'. Switching to .is('col', null) emits `col IS NULL` and the
migration finally finds its work.

Also makes the migration trigger idempotent and re-fires it on:
  - every successful loadOrUnlockUserKey
  - AuthContext startup when the user-key is already cached
so users stuck on 0.18.0 auto-recover the moment they install 0.18.1.

PinInput: focused + active-slot now show a brand-coloured ring, glow, and
a blinking caret so users see where the next keystroke lands.

packages/shared/src/chat/userKeyMigration.test.ts

@@ -26,7 +26,7 @@ describe('migrateOwnLegacyBundles', () => {
           return {
             select: () => ({
               in: () => ({
-                eq: () => Promise.resolve({
+                is: () => Promise.resolve({
                   data: [
                     {
                       conversation_id: 'conv-1',

packages/shared/src/chat/userKeyMigration.ts

@@ -48,12 +48,17 @@ export async function migrateOwnLegacyBundles(params: MigrateParams): Promise<Mi
   const result: MigrateResult = { migratedConversations: 0, errors: [] };
   if (params.ownLegacyDeviceIds.length === 0) return result;
 
+  // PostgREST translates `.eq('col', null)` to `col=eq.null` which evaluates as
+  // `col = NULL` — always false in SQL. `.is('col', null)` produces `col IS NULL`,
+  // which is what we want here. Wrong filter silently returned zero rows so the
+  // entire migration was a no-op (0.18.0 bug; users could set a PIN but no
+  // conv-key bundles got re-wrapped → "Awaiting key" on every send).
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const { data: rowsRaw, error } = await (params.client as any)
     .from('conversation_keys')
     .select('conversation_id, key_version, recipient_device_id, sender_device_id, sender_user_id, encrypted_key, nonce')
     .in('recipient_device_id', params.ownLegacyDeviceIds)
-    .eq('recipient_user_id', null as unknown as string);
+    .is('recipient_user_id', null);
   if (error) throw error;
   const rows = (rowsRaw ?? []) as LegacyRow[];
   if (rows.length === 0) return result;