feat(chat): disallow links in messages

Local-first chat between people whose web of trust is still forming is a
natural phishing/scam vector, so messages may not contain URLs. A
conservative `containsUrl` rule (explicit scheme, www., or a common-TLD
domain — but not "3.5kg" or "12.30") gates it: the composer warns and
keeps the text for editing, and MessagesCubit.send drops any URL as a
backstop. Incoming text was already non-tappable (plain selectable text).

apps/app_seeds/lib/domain/message_rules.dart

@@ -0,0 +1,19 @@
+/// Content rules for chat messages.
+///
+/// Links are not allowed in messages: it keeps the local-first, offline chat
+/// free of phishing/scam URLs between people who may not know each other yet
+/// (the web of trust is still forming). Enforced on send; incoming text is never
+/// rendered as a tappable link either (the bubble uses plain selectable text).
+library;
+
+/// Matches an obvious URL: an explicit scheme, a `www.` host, or a
+/// `domain.tld` with a common TLD. Kept deliberately conservative so ordinary
+/// text ("3.5kg", "F1 hybrid") doesn't trip it, while real links do.
+final RegExp _urlPattern = RegExp(
+  r'(https?://|www\.)\S+'
+  r'|\b[\w-]+\.(com|org|net|io|app|dev|es|eu|info|xyz|co|me|gg|link|shop|store|online|site|page|ru|cn|tk)\b',
+  caseSensitive: false,
+);
+
+/// Whether [text] contains something that looks like a URL.
+bool containsUrl(String text) => _urlPattern.hasMatch(text);