[2.8.0] Configure packet authenticity policy

[RCGV1]

Feature

Add the Packet authenticity selector specified in meshtastic/design#121 to the shared Android/Desktop Security configuration UI.

User experience

Under Security → Packet authenticity, expose the device SecurityConfig.packet_signature_policy with these ordered choices:

• Compatible — Accept unsigned: Verify signed broadcasts, but keep unsigned traffic for maximum compatibility.
• Balanced — Prefer signed: Recommended. Reject unsigned downgrade attempts from nodes known to sign.
• Strict — Require signed: Only show and process verified signed broadcasts. Older nodes and oversized broadcasts may disappear.

Balanced is the default/zero value. Strict requires a confirmation that calls out older firmware, licensed/ham nodes without PKI keys, oversized broadcasts, and reduced mesh visibility. PKI-encrypted direct messages remain available.

Acceptance criteria

• Read/write the firmware field; do not create a separate app-local filter.
• Gate the control for firmware/protobuf versions that support the setting.
• Follow existing shared Compose Multiplatform config patterns and localization/accessibility conventions.
• Keep shield=authentic and lock=private semantics from design#113.
• Tests cover mapping/defaults, config write, Strict confirmation/cancel, unsupported firmware, and state restoration.
• Screenshot evidence covers all three selections, confirmation, disabled state, light/dark, and relevant compact/adaptive layouts.
• Open the implementation PR as draft because end-to-end radio/hardware verification is pending.

[RCGV1]

Scope update from design#121: Strict is authenticated-only for every decryptable remote packet, not broadcast-only. New firmware signs signable non-PKI unicast/control packets as well as broadcasts; Strict accepts verified XEdDSA or successfully authenticated PKI and rejects other decrypted traffic regardless of portnum/destination. Use Strict supporting copy such as “Only show and process cryptographically authenticated mesh packets. Older nodes and oversized packets may disappear.”.

[RCGV1]

Implementation is actively in progress by @RCGV1 under meshtastic/design#121, with a draft PR forthcoming. GitHub does not currently allow this account to self-assign in this repository; please coordinate here before starting duplicate work.

[RCGV1]

Scope correction from design#121: this feature does not create a new authentication version and does not broaden normal-mode outbound signing. It only configures firmware receive enforcement using Meshtastic's existing XEdDSA/PKI results. Strict drops every decryptable remote packet that is not authenticated by an existing valid XEdDSA signature or successful existing PKI decryption before local storage/client/module/MQTT processing. Existing normal-mode broadcast signing and PKI direct-message behavior remain unchanged. Authenticated plaintext licensed/ham broadcasts and direct messages are tracked separately in design#122.