feat(trust): full Duniter web-of-trust membership (params + referents)

Slice 4 of Block 2. The pure rule was already parameterised; this adds the
policy, cold-start and UI around it.

- commons_core: WotParams (sigQty/stepMax/sigValidity, Duniter defaults) +
  WebOfTrust.membersWith; npubToHex helper (NIP-19 decode) for adding roots.
- WotSettings (keystore): the active parameters, configurable — a young
  network loosens them and tightens as it grows, as Ğ1 did. Defaults Duniter.
- TrustReferents: the bootstrap 'seeds' membership is measured from — a
  bundled asset (empty until real founders are curated, no invented keys)
  unioned with referents the user adds by npub/QR. Honest cold-start.
- TrustCubit: computes the full membership verdict against referents+params
  alongside the personal circle, and exposes a TrustTier (networkMember >
  inYourCircle > vouched > unknown). Certifications issued with the active
  validity (they expire and renew, Duniter rule).
- UI: chat trust badge by tier; a 'Network of trust' screen (manage roots +
  advanced params) reached from the profile. i18n en/es/pt/ast.

Tests: WotParams/membersWith, npubToHex, TrustReferents, WotSettings, and
TrustCubit tiers/membership. Resolves the WoT-parameters decision
(open-decisions §B). Trust net stays empty/undetermined until seeded — by
design; users bootstrap their own roots.

apps/app_seeds/lib/di/injector.dart

@@ -38,6 +38,8 @@ import '../services/profile_store.dart';
 import '../services/social_account_store.dart';
 import '../services/social_service.dart';
 import '../services/social_settings.dart';
+import '../services/trust_referents.dart';
+import '../services/wot_settings.dart';
 
 /// The app's service locator. Kept to the composition root — widgets get their
 /// repositories from here (or via BlocProvider), never by reaching into it deep
@@ -146,6 +148,9 @@ Future<void> configureDependencies() async {
     ..registerSingleton<LocaleStore>(LocaleStore(secretStore))
     ..registerSingleton<SocialSettings>(SocialSettings(secretStore))
     ..registerSingleton<SocialAccountStore>(accounts)
+    // Web of trust: network-wide (not per-identity), so registered once.
+    ..registerSingleton<TrustReferents>(TrustReferents(secretStore))
+    ..registerSingleton<WotSettings>(WotSettings(secretStore))
     ..registerSingleton<OfferOutbox>(OfferOutbox(secretStore))
     // Per-identity stores are namespaced by the active account's scope.
     ..registerSingleton<MessageStore>(