fix(omemo): guard NULL fingerprint decode and log failures (CWE-476/457)

Absorbs the still-relevant null-pointer guards from #107 and extends them for consistency across all _omemo_fingerprint_decode() callers:
- _omemo_fingerprint_decode(): return NULL on NULL input instead of dereferencing it via strlen().
- omemo_is_trusted_identity(): bail out (FALSE) when decode fails and zero-init fingerprint_len, instead of passing a NULL buffer / reading an uninitialized length into signal_buffer_append().
- omemo_trust(): bail out when decode fails (previously unchecked; under OOM it would save a bogus 1-byte identity).

Every decode failure is now logged (omemo_is_trusted_identity / omemo_trust / omemo_untrust) instead of failing silently; omemo_trust also surfaces a user-facing error.

The cmd_funcs.c hunks from #107 are dropped: master already has the strtok guard, and its fdopen guard is more complete (it closes the fd).

src/ui/window.c

@@ -43,7 +43,7 @@
 #include "ai/ai_client.h"
 
 static const int PAD_MIN_HEIGHT = 100;
-static const int PAD_DEAD_SPACE_LIMIT = 2000; // reclaim once the pad holds this much dead space (cursor past live buffer); size-independent, so it never fires while scrolling
+static const int PAD_THRESHOLD = 12000; // above buffer cap (~9000): reclaims dead pad space, never fires while scrolling
 static gboolean _in_redraw = FALSE;
 
 static void
@@ -56,10 +56,9 @@ _win_ensure_pad_capacity(ProfWin* window, WINDOW* win, int lines_needed)
     int cur_height = getmaxy(win);
     int cur_width = getmaxx(win);
     if (lines_needed >= cur_height - 1) {
-        // redraw to reclaim dead pad space (cursor far past live buffer, e.g. a long
-        // append-only session); dead space never accrues while scrolling, only here
-        int dead = window ? getcury(win) - window->layout->buffer->lines : 0;
-        if (window && dead > PAD_DEAD_SPACE_LIMIT && !_in_redraw) {
+        // If we are getting too large, trigger a redraw to clean up old lines
+        // but only if we are not already in a redraw process.
+        if (window && cur_height >= PAD_THRESHOLD && !_in_redraw) {
             win_redraw(window);
         } else {
             // resize to required lines + some buffer for next messages
@@ -68,20 +67,6 @@ _win_ensure_pad_capacity(ProfWin* window, WINDOW* win, int lines_needed)
         }
     }
 }
-
-// upper-bound estimate of rows a message body occupies (hard newlines + soft-wrap), to reserve pad space before printing so a tall message isn't clipped (a clipped height desyncs the scroll offset)
-static int
-_win_estimated_lines(WINDOW* win, const char* const message, int indent, int pad_indent)
-{
-    int usable = MAX(1, getmaxx(win) - (indent + pad_indent));
-    int newlines = 0;
-    for (const char* p = message; *p; p++) {
-        if (*p == '\n') {
-            newlines++;
-        }
-    }
-    return newlines + utf8_display_len(message) / usable + 2;
-}
 static const char* LOADING_MESSAGE = "Loading older messages…";
 static const char* CONS_WIN_TITLE = "CProof. Type /help for help information.";
 static const char* XML_WIN_TITLE = "XML Console";
@@ -2016,7 +2001,7 @@ _win_print_internal(ProfWin* window, const char* show_char, int pad_indent, GDat
         }
     }
 
-    _win_ensure_pad_capacity(window, window->layout->win, getcury(window->layout->win) + _win_estimated_lines(window->layout->win, message + offset, indent, pad_indent));
+    _win_ensure_pad_capacity(window, window->layout->win, getcury(window->layout->win));
 
     if (prefs_get_boolean(PREF_WRAP)) {
         _win_print_wrapped(window->layout->win, message + offset, indent, pad_indent);