fix: большой фикс недочетов и фикс пары язв

lib/backend/modules/account.dart

@@ -19,6 +19,11 @@ String _normalizeAuthPhone(String phone) {
   return '+$digits';
 }
 
+String _maskPhone(String phone) {
+  if (phone.length <= 5) return '***';
+  return '${phone.substring(0, 3)}***${phone.substring(phone.length - 2)}';
+}
+
 class PrivacyConfig {
   final String searchByPhone;
   final String incomingCall;
@@ -1408,7 +1413,7 @@ class AccountModule {
       'language': language,
     };
 
-    logger.i('Запрос OTP-кода: phone=$normalizedPhone type=${type.value}');
+    logger.i('Запрос OTP-кода: phone=${_maskPhone(normalizedPhone)} type=${type.value}');
 
     final packet = await _api.sendRequest(Opcode.authRequest, payload);
 

lib/backend/modules/chats.dart

@@ -191,6 +191,7 @@ class ChatsModule {
 
   static StreamSubscription<Packet>? _globalPushSub;
   static StreamSubscription<SessionState>? _globalStateSub;
+  static Future<void> _pushQueue = Future.value();
 
   static final Set<int> _dirtyChats = {};
   static final Set<int> _knownChats = {};
@@ -203,7 +204,7 @@ class ChatsModule {
   static void attachGlobalPushHandlers(Api api) {
     _globalPushSub?.cancel();
     _globalStateSub?.cancel();
-    _globalPushSub = api.pushStream.listen(_handleGlobalPush);
+    _globalPushSub = api.pushStream.listen(_enqueueGlobalPush);
     _globalStateSub = api.stateStream.listen(_handleSessionState);
     if (api.state != SessionState.online) {
       _markAllKnownChatsDirty();
@@ -240,6 +241,14 @@ class ChatsModule {
     _dirtyChats.addAll(_knownChats);
   }
 
+  static void _enqueueGlobalPush(Packet packet) {
+    _pushQueue = _pushQueue
+        .then((_) => _handleGlobalPush(packet))
+        .catchError((Object e) {
+          logger.w('Ошибка обработки пуша: $e');
+        });
+  }
+
   static Future<void> _handleGlobalPush(Packet packet) async {
     switch (packet.opcode) {
       case Opcode.notifMessage:

lib/backend/modules/digital_id.dart

@@ -286,6 +286,7 @@ class DigitalIdModule {
     await _send('DELETE', '/v3/digital-id/delete-profile');
     final accountId = await TokenStorage.getActiveAccountId();
     if (accountId != null) {
+      await TokenStorage.deleteSecure('${_tokenKey}_$accountId');
       await AppDatabase.setSyncValue(accountId, _tokenKey, '');
     }
   }
@@ -293,14 +294,23 @@ class DigitalIdModule {
   Future<String?> _storedToken() async {
     final accountId = await TokenStorage.getActiveAccountId();
     if (accountId == null) return null;
-    final value = await AppDatabase.getSyncValue(accountId, _tokenKey);
-    return (value != null && value.isNotEmpty) ? value : null;
+    final secureKey = '${_tokenKey}_$accountId';
+    final secured = await TokenStorage.readSecure(secureKey);
+    if (secured != null && secured.isNotEmpty) return secured;
+
+    final legacy = await AppDatabase.getSyncValue(accountId, _tokenKey);
+    if (legacy != null && legacy.isNotEmpty) {
+      await TokenStorage.writeSecure(secureKey, legacy);
+      await AppDatabase.setSyncValue(accountId, _tokenKey, '');
+      return legacy;
+    }
+    return null;
   }
 
   Future<void> _saveToken(String token) async {
     final accountId = await TokenStorage.getActiveAccountId();
     if (accountId != null) {
-      await AppDatabase.setSyncValue(accountId, _tokenKey, token);
+      await TokenStorage.writeSecure('${_tokenKey}_$accountId', token);
     }
   }
 

lib/backend/modules/file_uploader.dart

@@ -7,6 +7,7 @@ import '../api.dart';
 import '../../core/config/proxy_config.dart';
 import '../../core/protocol/opcode_map.dart';
 import '../../core/transport/proxy_connector.dart';
+import '../../core/transport/tls_config.dart';
 import '../../core/utils/logger.dart';
 import 'messages.dart';
 
@@ -158,11 +159,12 @@ class FileUploader {
         ? await ProxyConnector(proxySettings).connect(uri.host, uri.port)
         : await Socket.connect(uri.host, uri.port);
     if (uri.scheme != 'https') return base;
-    return SecureSocket.secure(
-      base,
-      host: uri.host,
-      onBadCertificate: (_) => true,
-    );
+    final allowInsecure = await TlsConfig.isInsecureAllowed();
+    if (allowInsecure) {
+      logger.w('TLS: проверка сертификата отключена (дебаг) — загрузка уязвима к MitM');
+      return SecureSocket.secure(base, host: uri.host, onBadCertificate: (_) => true);
+    }
+    return SecureSocket.secure(base, host: uri.host);
   }
 
   void _writeHeaders(

lib/backend/modules/messages.dart

@@ -250,6 +250,18 @@ class CachedMessage {
     );
   }
 
+  static List<CachedMessage> _decodeRows(List<Map<String, dynamic>> rows) =>
+      rows.map(CachedMessage.fromDbRow).toList();
+
+  static Future<List<CachedMessage>> fromDbRowsAsync(
+    List<Map<String, dynamic>> rows,
+  ) {
+    if (rows.length < 20) {
+      return Future.value(_decodeRows(rows));
+    }
+    return compute(_decodeRows, rows);
+  }
+
   Map<String, dynamic> toDbRow() => {
     'id': id,
     'account_id': accountId,
@@ -361,7 +373,7 @@ class MessagesModule {
       limit: limit,
       offset: offset,
     );
-    return rows.map(CachedMessage.fromDbRow).toList();
+    return CachedMessage.fromDbRowsAsync(rows);
   }
 
   CachedMessage? _parseMessage(