fix: OTR/presence/OMEMO correctness, stanza-id disco gate, build hardening

- OTR: strip the whitespace tag by shifting the full message tail incl. the NUL, not tag_length bytes, so the body is no longer duplicated for messages longer than the tag.
- presence: snapshot the resource fields before connection_add_available_resource() takes ownership, removing a use-after-free in the own-presence path.
- OMEMO: propagate _omemo_finalize_identity_load() failure on connect (log + cons_show_error + stop) instead of leaving OMEMO silently unavailable.
- OMEMO: guard NULL fingerprint decode in _omemo_fingerprint_decode / omemo_is_trusted_identity / omemo_trust and log every decode failure instead of failing silently.
- stanza-id: gate XEP-0359 dedup on disco urn:xmpp:sid:0 (the `by` JID or its domain), falling back to no-dedup when caps are unknown; add functional tests for trusted vs untrusted server.
- accounts: narrow the group-name sanitizer to the characters GKeyFile forbids in headers ([ ] \n \r), keeping `=` and `#`, so read/write stays symmetric.
- build: re-introduce compiler/sanitizer flags in a Pikaur-safe form (opt-in sanitizers, -Wsign-compare) and fix the resulting -Wsign-compare warnings (incl. proftest _mkdir_recursive).fix: OTR/presence/OMEMO correctness, stanza-id disco gate, build hardening

Author: jabber.developer2 <jabber.developer2@jabber.space>

src/database_flatfile_parser.c

@@ -553,7 +553,7 @@ ff_split_meta(const char* meta)
             continue;
         }
         if (*p == '|' || *p == '\0') {
-            g_ptr_array_add(arr, g_strndup(start, p - start));
+            g_ptr_array_add(arr, g_strndup(start, g_diff_to_gsize(p, start)));
             if (*p == '\0')
                 break;
             start = p + 1;
@@ -710,7 +710,7 @@ ff_parse_line(const char* line)
 
     if (bracket_start && first_space && first_space < bracket_start) {
         // Standard format with metadata: {timestamp} [{meta}] {sender}: {msg}
-        result->timestamp_str = g_strndup(work, first_space - work);
+        result->timestamp_str = g_strndup(work, g_diff_to_gsize(first_space, work));
 
         // Parse metadata section [...]
         const char* bracket_end = ff_find_unescaped_char(bracket_start + 1, ']');
@@ -721,7 +721,7 @@ ff_parse_line(const char* line)
             return NULL;
         }
 
-        auto_gchar gchar* meta_content = g_strndup(bracket_start + 1, bracket_end - bracket_start - 1);
+        auto_gchar gchar* meta_content = g_strndup(bracket_start + 1, g_diff_to_gsize(bracket_end, bracket_start + 1));
         char** parts = ff_split_meta(meta_content);
         if (parts) {
             _ff_parse_meta_parts(parts, result);
@@ -736,12 +736,12 @@ ff_parse_line(const char* line)
         // Find first *unescaped* ': ' which separates sender from message.
         const char* colon = ff_find_unescaped_colonspace(after_meta);
         if (colon) {
-            auto_gchar gchar* raw_sender = g_strndup(after_meta, colon - after_meta);
+            auto_gchar gchar* raw_sender = g_strndup(after_meta, g_diff_to_gsize(colon, after_meta));
 
             // Split sender into jid/resource, then unescape resource
             char* slash = strchr(raw_sender, '/');
             if (slash) {
-                result->from_jid = g_strndup(raw_sender, slash - raw_sender);
+                result->from_jid = g_strndup(raw_sender, g_diff_to_gsize(slash, raw_sender));
                 result->from_resource = ff_unescape_sender_resource(slash + 1);
             } else {
                 result->from_jid = g_strdup(raw_sender);
@@ -755,7 +755,7 @@ ff_parse_line(const char* line)
         }
     } else if (first_space) {
         // Legacy/simple format without metadata: {timestamp} - {sender}: {msg}
-        result->timestamp_str = g_strndup(work, first_space - work);
+        result->timestamp_str = g_strndup(work, g_diff_to_gsize(first_space, work));
         result->type = g_strdup("chat");
         result->enc = g_strdup("none");
 
@@ -767,10 +767,10 @@ ff_parse_line(const char* line)
 
         char* colon = strstr(rest, ": ");
         if (colon) {
-            char* sender = g_strndup(rest, colon - rest);
+            char* sender = g_strndup(rest, g_diff_to_gsize(colon, rest));
             char* slash = strchr(sender, '/');
             if (slash) {
-                result->from_jid = g_strndup(sender, slash - sender);
+                result->from_jid = g_strndup(sender, g_diff_to_gsize(slash, sender));
                 result->from_resource = g_strdup(slash + 1);
             } else {
                 result->from_jid = g_strdup(sender);