fix(messaging): saved conversations at once and a time limit on the status read; country first in address forms (#67, #70)

[BitcoinErrorLog]

Fixes pubky/pubky-marketplace#67 and pubky/pubky-marketplace#70. Release: Shop v0.6.46.

#67: buyer inbox and "Message seller" stuck on the placeholder

Cause. The inbox listed nothing until getMessagingStatus() (session resume, own-marker check under the receiver Web Lock, plaintext-history sweep) and then a full syncInbox pass had finished, one after the other. The status read had no time limit. On a production buyer seat, the empty inbox rendered in about 3 s normally, 9 s with 400 ms of emulated latency per request and 25 s at 1200 ms. Seven open tabs and HTTP/1.1 connection limits did not reproduce a stall on a fresh profile.

Fix.

• The inbox (/marketplace/messages and /messages) lists the conversations stored on the device as soon as it mounts, still behind the mute-list check. A slower, earlier list read never replaces a newer one.
• MessagingController.getMessagingStatus rejects after 20 s with "Connecting to private messages is taking longer than usual…". The work keeps running and the next read joins it. The listing conversation then shows Try again instead of an endless skeleton.
• ensureReceiverProvisioned is single-flight per session, so retried status reads don't queue more receiver-lock requests or marker reads.
• The status read waits at most 2 s for the plaintext-history sweep.
• A republished-key notice taken by a read that timed out is handed back for the next read to show.
• Missing private records, such as the never-written mute list, are read through the new HomeserverService.getJsonIfFound. A 404 is neither logged as an error nor reported to Sentry, and a missing directory listing logs at debug level. Corrupt or empty records still fail closed.

#70: Country first in address forms

• MarketplaceAddressFields asks for Country before Address line 1. Suggestions, the region list and postal rules follow the chosen country.
• New addresses in the address book, checkout and pickup details start at the region of the first browser locale that names one (for example en-GB gives GB), falling back to US. Saved addresses keep their country. Checkout sets the default after mount, so the server render and the first client render agree.

Verification

• Review: Kimi (OpenCode kimi-k3) full audit of 788e764d1..ac2d1f3db returned SHIP, with P2-1 fixed in 0304755f2 and P3s waived with reasons. The delta re-audit of ac2d1f3db..13b2af03a returned SHIP. Sol (gpt-5.6-sol-medium) was launched twice and returned no verdict either time.
• Gate: PREPUSH OK 972d4e549fc67caa9adc7834a81ba4d16820523f 655 full. Related unit tests: 486 files and 8,133 tests. Linux VRT: 64 specs, 51 marketplace files with 441 tests and 13 core files with 60 tests, in Chromium and Firefox.
• VRT baselines: 14 scenes × 2 browsers regenerated, only the address-field, checkout and award-checkout scenes that grew by the Country row (972d4e549). Every other scene passed unchanged. The negative check (one byte appended to a baseline) failed as expected.
• New tests fail on the old code. The inbox hook lists rows while status is pending (4 of 4 fail on the old hook).