feat(e2ee): undecryptable placeholder says why and offers the fix (#159)

'Unable to decrypt message' now carries one sentence per matrix-js-sdk
DecryptionFailureCode (describeDecryptionFailure, unit-tested against every
code so no raw code can leak into the copy) and, where something fixes it,
one button: no key backup → 'Set up key backup'; backup exists but this
session can't open it / key withheld for an unverified session → 'Unlock key
backup' / 'Verify this session' (both open Settings → Devices via a new
settingsRequestAtom that SettingsTab consumes); backup working or unknown
session (rust-crypto re-requests keys itself) → 'Retry', which re-runs
decryptEventIfNeeded. Sender-side problems are plain text. The raw code sits
in the placeholder's tooltip for support.

Verified headless on a fresh session in the encrypted seed room: each event
shows 'Sent before you signed in here, and no key backup exists…' with
tooltip HISTORICAL_MESSAGE_NO_KEY_BACKUP; the button opens Settings → Devices.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/app/utils/decryptionReason.test.ts

@@ -0,0 +1,44 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { DecryptionFailureCode } from 'matrix-js-sdk/lib/crypto-api';
+import { describeDecryptionFailure } from './decryptionReason';
+
+test('every SDK failure code maps to a sentence without the raw code in it', () => {
+  Object.values(DecryptionFailureCode).forEach((code) => {
+    const r = describeDecryptionFailure(code);
+    assert.ok(r.text.length > 10, code);
+    assert.ok(!r.text.includes(code), `raw code leaked for ${code}`);
+    assert.ok(!/[A-Z_]{8,}/.test(r.text), `shouty code-like text for ${code}: ${r.text}`);
+    if (r.action !== 'none') assert.ok(r.actionLabel, `action without label for ${code}`);
+  });
+});
+
+test('the fixable cases carry the right action', () => {
+  assert.equal(
+    describeDecryptionFailure(DecryptionFailureCode.HISTORICAL_MESSAGE_NO_KEY_BACKUP).action,
+    'setup-backup',
+  );
+  assert.equal(
+    describeDecryptionFailure(DecryptionFailureCode.HISTORICAL_MESSAGE_BACKUP_UNCONFIGURED).action,
+    'verify-session',
+  );
+  assert.equal(
+    describeDecryptionFailure(DecryptionFailureCode.HISTORICAL_MESSAGE_WORKING_BACKUP).action,
+    'retry',
+  );
+  assert.equal(
+    describeDecryptionFailure(DecryptionFailureCode.MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE)
+      .action,
+    'verify-session',
+  );
+  assert.equal(
+    describeDecryptionFailure(DecryptionFailureCode.MEGOLM_UNKNOWN_INBOUND_SESSION_ID).action,
+    'retry',
+  );
+  assert.equal(
+    describeDecryptionFailure(DecryptionFailureCode.UNKNOWN_SENDER_DEVICE).action,
+    'none',
+  );
+  assert.equal(describeDecryptionFailure(undefined).action, 'none');
+  assert.equal(describeDecryptionFailure('SOMETHING_NEW').text, 'Unable to decrypt this message.');
+});