fix: UX polish + legacy-account heal for missing encryption flags

- Mini-profile placeholder avatar: size mismatch (72 in a 64 wrapper)
  clipped the icon top-left of the circle. Match container size.
- PIN entry: Backspace on an empty cell now also wipes the digit it
  lands on, not just moves focus. Left/Right arrows navigate between
  cells.
- @everyone mentions + admin badges on first chat open were missing
  because the admin list arrives async from get_mls_group_members and
  messages render before it lands. Re-render rows from now-known admins
  in refreshGroupMemberCount when the chat is open.
- Legacy accounts predating the encryption_enabled / security_type
  settings rows would brick on the multi-account branch — the new
  resolver treats missing-both as "not encrypted" and routes to the
  direct-login path which then fails to parse the ciphertext pkey.
  Self-heal: detect non-nsec1 pkey on boot, backfill encryption_enabled
  = "true" and security_type = "pin" (pre-Feb-2026 only had PIN). One-
  time fix; modern accounts go through commit_account_setup which writes
  both flags atomically.
- Login screen: subtext + credits hid too eagerly (300px / 600px) given
  the 650px default window. Bumped to 325px / 625px so neither folds at
  default size. When credits hide, reclaim 16px bottom padding on
  #login-start so the Login button doesn't kiss the viewport edge.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JSKitty

src-tauri/src/commands/encryption.rs

@@ -156,11 +156,40 @@ pub fn get_encryption_and_key<R: Runtime>(handle: AppHandle<R>) -> Result<BootEn
     // delegate to `state::resolve_encryption_enabled_from_db` so this is
     // robust against either being called independently.
     crate::state::init_encryption_enabled();
-    let enabled = vector_core::state::is_encryption_enabled_fast();
+    let mut enabled = vector_core::state::is_encryption_enabled_fast();
+
+    // Self-heal: legacy accounts predating the `encryption_enabled` row
+    // store an encrypted pkey with no flag set. A pkey that doesn't begin
+    // with `nsec1` is ciphertext — backfill the flags so the boot routes
+    // to the PIN screen. Default to "pin" because passwords didn't exist
+    // before the security_type row was introduced.
+    let mut healed_security_type: Option<String> = None;
+    if !enabled {
+        if let Ok(Some(stored)) = vector_core::db::get_pkey() {
+            if !stored.starts_with("nsec1") {
+                let _ = vector_core::db::set_sql_setting(
+                    "encryption_enabled".to_string(),
+                    "true".to_string(),
+                );
+                if crate::db::get_sql_setting("security_type".to_string())
+                    .ok().flatten().is_none()
+                {
+                    let _ = vector_core::db::set_sql_setting(
+                        "security_type".to_string(),
+                        "pin".to_string(),
+                    );
+                    healed_security_type = Some("pin".to_string());
+                }
+                vector_core::state::set_encryption_enabled(true);
+                enabled = true;
+            }
+        }
+    }
 
     let security_type = if enabled {
-        crate::db::get_sql_setting("security_type".to_string())
-            .ok().flatten().unwrap_or_else(|| "pin".to_string())
+        healed_security_type
+            .or_else(|| crate::db::get_sql_setting("security_type".to_string()).ok().flatten())
+            .unwrap_or_else(|| "pin".to_string())
     } else {
         "pin".to_string()
     };

src/js/render/mini-profile.js

@@ -137,11 +137,11 @@ function _populateMiniProfile(popup, npub, profile) {
         img.alt = '';
         img.draggable = false;
         img.onerror = () => {
-            img.replaceWith(createPlaceholderAvatar(false, 72));
+            img.replaceWith(createPlaceholderAvatar(false, 64));
         };
         avatarWrap.appendChild(img);
     } else {
-        avatarWrap.appendChild(createPlaceholderAvatar(false, 72));
+        avatarWrap.appendChild(createPlaceholderAvatar(false, 64));
     }
     popup.appendChild(avatarWrap);
 

src/main.js

@@ -1557,6 +1557,22 @@ async function refreshGroupMemberCount(groupId) {
         if (strOpenChat === groupId) {
             // Update the chat header subtext (respects typing indicators)
             updateChatHeaderSubtext(chat);
+
+            // Admin list arrives async — re-render rows from now-known
+            // admins so admin badges + @everyone treatment apply.
+            const admins = chat.metadata?.admins;
+            if (Array.isArray(admins) && admins.length > 0 && domChatMessages) {
+                const adminSet = new Set(admins);
+                const rows = domChatMessages.querySelectorAll('.dmsg');
+                rows.forEach(row => {
+                    const m = row._dmsgMsg;
+                    if (!m || m.mine) return;
+                    const senderNpub = m.npub || '';
+                    if (!adminSet.has(senderNpub)) return;
+                    const profile = getProfile(senderNpub);
+                    row.replaceWith(renderMessage(m, profile, m.id));
+                });
+            }
         }
     } catch (e) {
         console.warn('Failed to refresh group member count for', groupId, e);
@@ -4366,9 +4382,21 @@ function openEncryptionFlow(fUnlock = false, securityType = 'pin') {
                         const newTitle = fUnlock ? DECRYPTION_PROMPT : (strPinLast.length > 0 ? RE_ENTER_PROMPT : INITIAL_ENCRYPTION_PROMPT);
                         updateStatusMessage(newTitle);
                     }
-                    input.value = '';
-                    strPinCurrent[nIndex] = '-';
+                    if (input.value !== '') {
+                        input.value = '';
+                        strPinCurrent[nIndex] = '-';
+                    } else if (nIndex > 0) {
+                        const prev = arrPinDOMs[nIndex - 1];
+                        prev.value = '';
+                        strPinCurrent[nIndex - 1] = '-';
+                        prev.focus();
+                    }
+                } else if (event.key === 'ArrowLeft') {
+                    event.preventDefault();
                     if (nIndex > 0) arrPinDOMs[nIndex - 1].focus();
+                } else if (event.key === 'ArrowRight') {
+                    event.preventDefault();
+                    if (nIndex + 1 < arrPinDOMs.length) arrPinDOMs[nIndex + 1].focus();
                 } else if (event.key.length === 1 && !event.key.match(/^[0-9]$/)) {
                     event.preventDefault();
                 }

src/styles.css

@@ -5723,7 +5723,7 @@ select:disabled:hover {
   font-size: clamp(10px, 2.4vh, 16px);
 }
 
-@media (max-height: 300px) {
+@media (max-height: 325px) {
   .login-logo {
     display: none;
   }
@@ -5755,14 +5755,15 @@ select:disabled:hover {
   }
 }
 
-@media (max-height: 600px) {
+@media (max-height: 625px) {
   .login-credits {
     display: none;
   }
 
-  #login-start,
-  .login-encrypt-container {
-    padding-bottom: 20px;
+  /* Credits provided the bottom breathing room; reclaim it on the
+     button stack so Login doesn't kiss the viewport edge. */
+  #login-start {
+    padding-bottom: 16px;
   }
 }