feat(ui): make the live persona unmistakable

[kNoAPP]

Part of #353. Phase 3. Depends on the switch ceremony.

Problem or Motivation

Once a user holds several personas, the most likely failure is no longer cryptographic — it is human. Sending a message from the wrong identity cannot be undone: the packet is on the air, signed by a key the user did not mean to use, and on a mesh there is no recall.

Phases 1 and 2 make the personas exist and switch correctly. Nothing yet makes the live one unmistakable at a glance.

Proposed Solution

Small, cheap affordances that make the active persona impossible to mistake.

Per-identity accent colour

Stored in the persona's vault metadata and applied to the chrome — the header, the action bar, or both. The existing theming already runs on CSS variables in app/globals.css, so this is a variable override rather than new styling.

Must work in light and dark, and must not be the only signal, since colour alone fails for colour-blind users and in monochrome. Pair it with the label.

Fingerprint avatar

A deterministic glyph or colour block derived from the public key, shown next to the persona's name. Useful beyond identity switching — it is the same problem contacts already have, so consider whether it belongs somewhere shared rather than scoped to personas.

Contacts-to-re-share nudge

After a switch, the persona's contacts cannot reach the user until they re-add the new key — contacts survive the import but their ECDH secret no longer matches. A dismissable prompt offering to re-share the contact card closes a loop that otherwise leaves the user wondering why nobody replies.

This one is arguably the most valuable of the three, because it addresses a genuine confusion rather than a cosmetic one. Consider pulling it forward into the switch ceremony if it proves load-bearing there.

Constraints

All strings localized. Accent colours are per-radio preferences and therefore travel in the persona's vault metadata, not localStorage — only locale and theme are permitted there, per AGENTS.md.

[kNoAPP]

Two premises in this ticket don't hold at HEAD

Addressed in #386.

The re-share nudge solves a problem that doesn't exist

contacts survive the import but their ECDH secret no longer matches

• Firmware: the CMD_IMPORT_PRIVATE_KEY handler in examples/companion_radio/MyMesh.cpp calls resetContacts() and then loadContacts(), commented "re-load contacts, to invalidate ecdh shared_secrets". ContactInfo::getSharedSecret then recomputes each secret lazily from the new self_id. The radio's side of every secret follows the key.
• App: since feat(identity): add the per-persona radio-state blob with capture and apply #383/feat(ui): add the identity list and persona switch ceremony #385 a switch doesn't keep the outgoing contacts. It applies the incoming persona's own saved contact set, whose peers already hold that persona's key. A freshly minted persona starts with no contacts.

So nobody needs to re-add anything, and a nudge would tell users to fix something that isn't broken. #386 leaves it out.

The accent can't live in vault metadata

The vault is sealed under a passphrase and only unlocked inside Settings, so an accent stored there couldn't frame the chrome at connect time. AGENTS.md also reserves the vault store for the vault alone. #386 stores the accent in the per-radio preferences blob instead. That blob is keyed ${pubkey}:preferences, so it is already per persona.