feat(ui): add the identity list and persona switch ceremony

[kNoAPP]

Part of #353. Depends on the SLIP-0010 derivation and the persona blob.

Problem or Motivation

With derivation and persona capture/apply in place, the user still has no way to see which personas exist or to make one live. This ticket is the surface.

Switching is not a toggle. It is a write to flash, a reboot, a reconnect, a tier-1 replay including up to 100 contact operations, and a self-advert. Research for #353 puts a worst-case switch at roughly 15-30 seconds. A UI that presents it as instant will be experienced as broken.

Proposed Solution

Identity list

Rendered from vault metadata, so it works without the seed present: label, derivation index, public key fingerprint, and which persona is live. Creating a new persona derives the next usable index, applying the 0x00 / 0xFF skip rule.

The switch ceremony

The full sequence, which is not just the key write:

1. Flush tier-2 data under the outgoing public key.
2. Capture the outgoing persona's tier-1 state, so unsaved radio-side changes are not lost.
3. importPrivateKey, then reboot.
4. Reconnect and derive the new namespace and subkey.
5. Replay the incoming persona's tier-1 state — name, location, channels, contacts.
6. Hydrate tier-2 data.
7. Send a self-advert.

Steps 3-5 interact with #355, which is what makes a deliberate public-key change carry browser data correctly, and with #354's answer on whether tier-1 replay can precede the reboot.

Progress and interruption

• Show real progress, especially across contact reconciliation, which is the long pole.
• Support cancel. A user who started a switch by mistake must not be forced to wait it out.
• Be resumable. A link drop partway through leaves the radio in a mixed state — new identity, partially applied persona. The app must detect this on reconnect and offer to finish, rather than presenting a half-applied persona as though it were complete. This is the hardest part of the ticket and deserves the most care.

Guard rail

Refuse to run two radios on the same identity at once. It is the obvious "put my main identity on the handheld and the base station" move, and it breaks dedup and ACK semantics on the mesh. If the vault has seen this identity live on a different device, warn hard.

Verification

Switch between two personas repeatedly and confirm each time that the radio reports the expected public key, name, location and contact set, and that each persona's message history is the one that reappears.

Pull the cable mid-switch and confirm the app recovers into a coherent state rather than a silently half-applied one.