refactor: swap device-id contexts for user-id contexts at call sites

Renames DecryptParams.ownDeviceId to ownUserId so decryptMessages actually
looks up bundles by user. Sweeps remaining OwnDeviceCtx and
loadDevicePrivateKey consumers in the desktop app to use cachedUserKey
from userIdentity. Files scheduled for deletion in later tasks
(BackupExportDialog, DeviceRestore, BackupRestoreDialog, BackupPromptBanner,
deviceBackup, DeviceRegistration) are left untouched.

apps/desktop/src/lib/useConversationMessages.ts

@@ -1,4 +1,3 @@
-import { loadDevicePrivateKey } from '@chat-app/shared/auth';
 import {
   type AttachmentHandle,
   type DecryptedMessage,
@@ -30,8 +29,8 @@ import {
   shouldGiveUp,
   subscribeOutbox,
 } from './messageOutbox';
-import { devLocalSecretStore } from './secretStore';
 import { supabase } from './supabase';
+import { cachedUserKey } from './userIdentity';
 
 interface State {
   messages: DecryptedMessage[];
@@ -90,25 +89,25 @@ export function useConversationMessages({ conversationId, userId, deviceId }: Ar
     });
   }, [conversationId]);
 
-  // Load own private key once per (user, device).
+  // Load own user private key once per user.
   useEffect(() => {
     privateKeyRef.current = null;
-    if (!userId || !deviceId) return;
-    void loadDevicePrivateKey(devLocalSecretStore, userId, deviceId).then((pk) => {
+    if (!userId) return;
+    void cachedUserKey(userId).then((pk) => {
       privateKeyRef.current = pk;
     });
-  }, [userId, deviceId]);
+  }, [userId]);
 
   const decryptBatch = useCallback(
     async (messages: MessageWithCipher[]): Promise<DecryptedMessage[]> => {
       const priv = privateKeyRef.current;
-      if (!priv || !deviceId || messages.length === 0) {
+      if (!priv || !userId || messages.length === 0) {
         return messages.map((m) => ({ ...m, plaintext: null }));
       }
       return decryptMessages({
         client: supabase,
         messages,
-        ownDeviceId: deviceId,
+        ownUserId: userId,
         ownPrivateKey: priv,
         // Offload the symmetric decrypt + utf-8 decode to a Web Worker so
         // the main thread stays responsive during bulk operations (initial
@@ -116,7 +115,7 @@ export function useConversationMessages({ conversationId, userId, deviceId }: Ar
         aeadBatchDelegate: decryptBatchWorker,
       });
     },
-    [deviceId],
+    [userId],
   );
 
   const refresh = useCallback(async () => {