refactor(ui): centralize physical paint through prof_doupdate()

Upstream's "guard terminal writes while suspended" fix and commit 2 of
this branch both work by sprinkling `if (!isendwin())` (or
`!is_suspended && !isendwin()`) guards around every doupdate() reachable
during a suspended session. That keeps isendwin() a valid signal but
turns the no-stray-write invariant into a whitelist: every new
doupdate / refresh / wrefresh added later in src/ has to remember the
guard, and the original bug class came from exactly such an oversight
in _inp_write.

Introduce a single primitive, prof_doupdate(), that flushes only when
not suspended (via the existing _ui_redraw_suspended() helper). Replace
every direct doupdate() in src/ui/inputwin.c (inp_get_line,
inp_get_password, _inp_write) and the trailing doupdate in ui_update
with the wrapper, collapsing their inline guards. ui_suspend() now
flushes via prof_doupdate() before flipping ui_suspended, so upstream's
pre-endwin flush is preserved.

The flag-based gate in ui_update / ui_resize / ui_redraw is kept as
belt-and-suspenders: even if a future raw doupdate slips in elsewhere,
ui_update has not been refreshing the virtual screen, so the blit finds
stale content rather than a fresh status-bar clock or chat line.

src/ui/core.c

@@ -148,7 +148,7 @@ ui_update(void)
     title_bar_update_virtual();
     status_bar_draw();
     inp_put_back();
-    doupdate();
+    prof_doupdate();
 
     if (perform_resize) {
         perform_resize = FALSE;
@@ -189,9 +189,10 @@ ui_reset_idle_time(void)
 void
 ui_suspend(void)
 {
-    ui_suspended = TRUE;
     inp_suspend();
-    doupdate();
+    // Flush before flipping the flag (prof_doupdate skips while suspended).
+    prof_doupdate();
+    ui_suspended = TRUE;
     endwin();
 }
 
@@ -219,6 +220,14 @@ ui_flash(void)
     }
 }
 
+void
+prof_doupdate(void)
+{
+    if (!_ui_redraw_suspended()) {
+        doupdate();
+    }
+}
+
 void
 ui_resize(void)
 {

src/ui/inputwin.c

@@ -317,10 +317,7 @@ inp_get_line(void)
     werase(inp_win);
     wmove(inp_win, 0, 0);
     _inp_win_update_virtual();
-    // Don't write to the terminal while suspended (external editor active).
-    if (!is_suspended && !isendwin()) {
-        doupdate();
-    }
+    prof_doupdate();
     char* line = NULL;
     while (!line) {
         line = inp_readline();
@@ -351,10 +348,7 @@ inp_get_password(void)
     werase(inp_win);
     wmove(inp_win, 0, 0);
     _inp_win_update_virtual();
-    // Don't write to the terminal while suspended (external editor active).
-    if (!is_suspended && !isendwin()) {
-        doupdate();
-    }
+    prof_doupdate();
     char* password = NULL;
     get_password = TRUE;
     while (!password) {
@@ -479,9 +473,7 @@ _inp_write(char* line, int offset)
     _inp_win_handle_scroll();
 
     _inp_win_update_virtual();
-    if (!isendwin()) {
-        doupdate();
-    }
+    prof_doupdate();
 }
 
 static int

src/ui/ui.h

@@ -43,6 +43,10 @@ void ui_load_colours(void);
 void ui_update(void);
 void ui_redraw(void);
 void ui_resize(void);
+// Centralised physical-paint primitive: flushes the virtual screen unless the
+// UI is suspended (external editor active) or the screen has been closed. Use
+// this instead of raw doupdate() in any path reachable while suspended.
+void prof_doupdate(void);
 void ui_focus_win(ProfWin* window);
 void ui_sigwinch_handler(int sig);
 void ui_handle_otr_error(const char* const barejid, const char* const message);

tests/unittests/ui/stub_ui.c

@@ -85,6 +85,10 @@ void
 ui_resize(void)
 {
 }
+void
+prof_doupdate(void)
+{
+}
 
 void
 ui_focus_win(ProfWin* win)