fix(privacy): wipe plaintext/PII localStorage caches on logout (SEC-1/2)

Several localStorage caches held decrypted message content or user PII and
survived a normal logout, leaving residue on a shared device (the search
index was already wiped; these were not):

- cinny_scheduled_messages_v1 - decrypted IContent.body of pending sends
- cinny_recent_searches_v1     - search query text
- cinny_recent_forward_targets_v1 - recent forward contact/room graph
- cinny_recent_gifs_v1 / cinny_recent_stickers_v1 - media the user sent
- navToActivePath<userId>       - per-space last-visited room paths
- (plus the translation cache added earlier)

Add a clear function per module and a single auditable clearPlaintextCaches()
aggregator, called from both logout paths (logoutClient + the server-forced
SessionLoggedOut handler) alongside the existing session/search-index wipes.
Unit-tested.

Deliberately NOT cleared (documented in the aggregator): unsent composer
drafts and the presence status message (preserved by product decision N98);
SDK sync/crypto store + io.lotus.* account data (reminders/bookmarks/notes),
already wiped by mx.clearStores(); low-sensitivity UI/metadata residue.

The forward-targets/gifs/stickers/nav-path additions and the accurate
"not covered" documentation address findings from two review passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/state/recentGifs.ts

@@ -48,3 +48,16 @@ export const addRecentGif = (
   const withoutDupe = prev.filter((g) => g.url !== gif.url);
   return [gif, ...withoutDupe].slice(0, max);
 };
+
+/**
+ * Wipe persisted recent GIFs. Called on logout — these are media the user sent
+ * (can be personally sensitive) and must not surface under "Recent" to the next
+ * person on a shared device.
+ */
+export const clearRecentGifs = (): void => {
+  try {
+    localStorage.removeItem(STORAGE_KEY);
+  } catch {
+    /* localStorage unavailable — nothing to clear */
+  }
+};