refactor: swap device-id contexts for user-id contexts at call sites

Renames DecryptParams.ownDeviceId to ownUserId so decryptMessages actually
looks up bundles by user. Sweeps remaining OwnDeviceCtx and
loadDevicePrivateKey consumers in the desktop app to use cachedUserKey
from userIdentity. Files scheduled for deletion in later tasks
(BackupExportDialog, DeviceRestore, BackupRestoreDialog, BackupPromptBanner,
deviceBackup, DeviceRegistration) are left untouched.

apps/desktop/src/components/AppShell.tsx

@@ -1,4 +1,3 @@
-import { loadDevicePrivateKey } from '@chat-app/shared/auth';
 import { useEffect } from 'react';
 import { Outlet } from 'react-router-dom';
 
@@ -6,7 +5,7 @@ import { useAuth } from '../context/AuthContext';
 import { startConversationKeySync } from '../lib/conversationKeySync';
 import { startDeviceApprovalListener } from '../lib/deviceApproval';
 import { ensureNotificationPermission } from '../lib/osNotify';
-import { devLocalSecretStore } from '../lib/secretStore';
+import { cachedUserKey } from '../lib/userIdentity';
 import { BackupPromptBanner } from './BackupPromptBanner';
 import { CallUI } from './CallUI';
 import { DeviceApprovalBanner } from './DeviceApprovalBanner';
@@ -28,7 +27,7 @@ export function AppShell() {
     const stopApproval = startDeviceApprovalListener({
       ownUserId: userId,
       ownDeviceId: deviceId,
-      getPriv: () => loadDevicePrivateKey(devLocalSecretStore, userId, deviceId),
+      getPriv: () => cachedUserKey(userId),
     });
     return () => {
       stopKeySync();