feat(sharing): make going online opt-in, and show what it unlocks

Tane dialled its four default relays at launch, before anyone had asked
for anything — an F-Droid reviewer spotted it, and they were right. The
seed book needs no network at all, so the app should not have one until
the person joins the sharing side.

- SocialSettings gains a three-state `sharingEnabled`. `null` means
  "never asked", which is what lets `migrateSharingEnabled` keep an
  existing install exactly as it was: anyone past the intro was on a
  build that connected at launch, so they keep messaging, device sync
  and offer alerts. A fresh install starts fully offline.
- bootstrap only starts the shared connection when sharing is on. The
  inbox/sync/plantaré/alert listeners are untouched: they react to a
  session, and none arrives.
- SharingSwitch is the single place that moves the stored choice, the
  live connection and the flag the UI listens to, so they cannot drift.
- Agreeing to the community rules is the opt-in — one consent surface,
  reached from the market or from the drawer's invitation.
- SocialConnection.start is now idempotent and gains stop(), so turning
  sharing off goes offline immediately instead of at the next launch.
- The social drawer entries stay visible but padlocked while sharing is
  off; tapping one explains what wakes up and offers to join. Hiding
  them would have kept the tool a secret. "Coming soon" is gone for
  good — everything it labelled is built.

Covered by tests for the migration in both directions, start/stop
lifecycle, the gate turning sharing on, the invitation, and the drawer
in all three states (no social layer / off / on).

apps/app_seeds/lib/bootstrap.dart

@@ -23,6 +23,7 @@ import 'services/profile_store.dart';
 import 'services/saved_offers_store.dart';
 import 'services/saved_search_alert_service.dart';
 import 'services/saved_searches_store.dart';
+import 'services/sharing_switch.dart';
 import 'services/social_account_store.dart';
 import 'services/social_connection.dart';
 import 'services/social_service.dart';
@@ -81,14 +82,24 @@ class _BootstrapState extends State<Bootstrap> {
     final savedSearchAlerts = getIt.isRegistered<SavedSearchAlertService>()
         ? getIt<SavedSearchAlertService>()
         : null;
+    // Sharing is opt-in: the app must not touch the network until the person
+    // has joined the sharing side. An install from before this setting keeps
+    // whatever it had (see `migrateSharingEnabled`) so nobody silently loses
+    // messaging on upgrade.
+    final introSeen = await onboarding.introSeen();
+    final sharingOn = await getIt<SocialSettings>().migrateSharingEnabled(
+      introSeen: introSeen,
+    );
+
     // Subscribe the inbox + sync + plantaré + saved-search listeners BEFORE the
     // shared connection starts connecting, so the first session is caught; then
-    // bring the connection up.
+    // bring the connection up. The listeners are harmless while sharing is off:
+    // they only ever react to a session, and none arrives.
     inbox?.start();
     sync?.start();
     plantares?.start();
     savedSearchAlerts?.start();
-    connection?.start();
+    if (sharingOn) connection?.start();
 
     return TaneApp(
       repository: getIt<VarietyRepository>(),
@@ -108,7 +119,12 @@ class _BootstrapState extends State<Bootstrap> {
       socialAccounts: getIt<SocialAccountStore>(),
       inbox: inbox,
       notifications: notifications,
-      showIntro: !await onboarding.introSeen(),
+      showIntro: !introSeen,
+      sharing: SharingSwitch(
+        settings: getIt<SocialSettings>(),
+        connection: connection,
+        enabled: sharingOn,
+      ),
       autoBackup: getIt.isRegistered<AutoBackupService>()
           ? getIt<AutoBackupService>()
           : null,