feat(sharing): make going online opt-in, and show what it unlocks

Tane dialled its four default relays at launch, before anyone had asked
for anything — an F-Droid reviewer spotted it, and they were right. The
seed book needs no network at all, so the app should not have one until
the person joins the sharing side.

- SocialSettings gains a three-state `sharingEnabled`. `null` means
  "never asked", which is what lets `migrateSharingEnabled` keep an
  existing install exactly as it was: anyone past the intro was on a
  build that connected at launch, so they keep messaging, device sync
  and offer alerts. A fresh install starts fully offline.
- bootstrap only starts the shared connection when sharing is on. The
  inbox/sync/plantaré/alert listeners are untouched: they react to a
  session, and none arrives.
- SharingSwitch is the single place that moves the stored choice, the
  live connection and the flag the UI listens to, so they cannot drift.
- Agreeing to the community rules is the opt-in — one consent surface,
  reached from the market or from the drawer's invitation.
- SocialConnection.start is now idempotent and gains stop(), so turning
  sharing off goes offline immediately instead of at the next launch.
- The social drawer entries stay visible but padlocked while sharing is
  off; tapping one explains what wakes up and offers to join. Hiding
  them would have kept the tool a secret. "Coming soon" is gone for
  good — everything it labelled is built.

Covered by tests for the migration in both directions, start/stop
lifecycle, the gate turning sharing on, the invitation, and the drawer
in all three states (no social layer / off / on).

apps/app_seeds/test/ui/sharing_invite_sheet_test.dart

@@ -0,0 +1,92 @@
+import 'package:flutter/material.dart';
+import 'package:flutter_localizations/flutter_localizations.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:tane/i18n/strings.g.dart';
+import 'package:tane/services/onboarding_store.dart';
+import 'package:tane/services/sharing_switch.dart';
+import 'package:tane/ui/sharing_invite_sheet.dart';
+
+import '../support/test_support.dart';
+
+void main() {
+  Widget host(OnboardingStore store, SharingSwitch sharing) =>
+      TranslationProvider(
+        child: MaterialApp(
+          localizationsDelegates: GlobalMaterialLocalizations.delegates,
+          home: Builder(
+            builder: (context) => Center(
+              child: ElevatedButton(
+                onPressed: () => showSharingInvite(
+                  context,
+                  onboarding: store,
+                  sharing: sharing,
+                ),
+                child: const Text('tap a locked entry'),
+              ),
+            ),
+          ),
+        ),
+      );
+
+  testWidgets('the invite says what lights up and that it needs a connection',
+      (tester) async {
+    LocaleSettings.setLocaleSync(AppLocale.en);
+    await tester.pumpWidget(
+      TranslationProvider(
+        child: const MaterialApp(
+          localizationsDelegates: GlobalMaterialLocalizations.delegates,
+          home: Scaffold(body: SharingInviteSheet()),
+        ),
+      ),
+    );
+    await tester.pump();
+
+    expect(find.text('This wakes up when you start sharing'), findsOneWidget);
+    expect(find.text('Write to whoever has seeds near you'), findsOneWidget);
+    expect(find.text('Keep the offers you like'), findsOneWidget);
+    expect(find.text('Your circle of people you trust'), findsOneWidget);
+    // The honest part: it is not free of consequences.
+    expect(find.textContaining('go online'), findsOneWidget);
+  });
+
+  testWidgets('"Not now" leaves the app exactly as offline as it was',
+      (tester) async {
+    LocaleSettings.setLocaleSync(AppLocale.en);
+    final store = OnboardingStore(InMemorySecretStore());
+    final sharing = newTestSharingSwitch(enabled: false);
+
+    await tester.pumpWidget(host(store, sharing));
+    await tester.tap(find.text('tap a locked entry'));
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const Key('sharingInvite.notNow')));
+    await tester.pumpAndSettle();
+
+    expect(sharing.on.value, isFalse);
+    expect(await store.marketRulesAccepted(), isFalse);
+  });
+
+  testWidgets('accepting the invite goes through the community rules once',
+      (tester) async {
+    LocaleSettings.setLocaleSync(AppLocale.en);
+    final store = OnboardingStore(InMemorySecretStore());
+    final sharing = newTestSharingSwitch(enabled: false);
+
+    await tester.pumpWidget(host(store, sharing));
+    await tester.tap(find.text('tap a locked entry'));
+    await tester.pumpAndSettle();
+
+    await tester.tap(find.byKey(const Key('sharingInvite.start')));
+    await tester.pumpAndSettle();
+
+    // Same single consent surface the market uses — not a second one.
+    expect(find.text('Before you join the market'), findsOneWidget);
+    expect(sharing.on.value, isFalse, reason: 'not online until they agree');
+
+    await tester.tap(find.text('I agree'));
+    await tester.pumpAndSettle();
+
+    expect(sharing.on.value, isTrue);
+    expect(await store.marketRulesAccepted(), isTrue);
+  });
+}