Name your devices from their last-resort KeyPackage (GRYT-1764)

[grytchat]

Part of GRYT-1764, with Gryt-chat/server#298. A device you don't share an MLS group with had no name, so a new one showed as a nameless "New device linked".

What changes

• MlsListedDevice gets an optional lastResortKeyPackage, which the server now sends for your own devices.

• ownDevices() reads a device's name from it, after the group leaves. It only uses the name when:

  • readMlsKeyPackage verifies the package (suite, lifetime, signature, certificate for this server and leaf key);
  • the certificate's device id matches the listed device;
  • the certificate is under your own person key.

  Anything that fails stays unnamed rather than misnamed.

• The fake delivery service lists your own devices with their newest last-resort package.

Checked

• npm test: 210 pass.
• The old test "the tablet is in no group yet, so nothing here shows its name" now expects the tablet's name, and from the tablet, the others'.
• New test: the server swaps somebody else's package in for one of your devices, and its name doesn't show. Removing the person-key check makes that test fail.
• tsc --noEmit is clean.

Look at: the trust check in ownDeviceNames, the for (const x of listed) block.

Needs a core release, and the client to pick up that version. Until the server sends the field it does nothing.

GRYT-1764

🤖 Generated with Claude Code