feat(sync): warn before overwriting a newer remote copy (conflict guard)

Saves push silently as before, but if the relay copy is NEWER than the one this
device last pushed (another device changed it), the user is now asked to confirm
before overwriting — preventing a silent multi-device clobber. No nag on normal
saves.

- js/services/settingsSyncFlags.js: track per-pubkey+kind last-pushed created_at
  (getSyncPushedAt/setSyncPushedAt).
- js/services/syncConflict.js: pushWithConflictCheck — peek remote created_at
  (list-only, no decrypt), compare to last push, call confirmOverwrite only on a
  real conflict, then push strictly-newer than remote so the replace wins.
- storage/walletSyncService push()/enable() route through it and accept a
  confirmOverwrite callback.
- ProfileStorage/WalletController supply confirmOverwrite (window.confirm) and
  surface a "kept the newer copy" status when the user declines.

tests/sync-conflict.test.mjs: no-remote→silent, newer→prompt(+decline blocks
push), confirm→strictly-newer push, older→no prompt. Mutation-verified
(ignoring the decline fails). Service-test twins gained exists().

Co-Authored-By: Claude Opus 4.8 <[email protected]>

js/ui/profileModal/ProfileWalletController.js

@@ -102,6 +102,16 @@ export class ProfileWalletController {
     return this._walletSyncService;
   }
 
+  confirmSyncOverwrite() {
+    if (typeof window === "undefined" || typeof window.confirm !== "function") {
+      return true;
+    }
+    return window.confirm(
+      "A newer copy of your wallet connection is on your account (changed on " +
+        "another device). Overwrite it with this one?"
+    );
+  }
+
   renderSyncSection(pubkey) {
     if (!(this.walletSyncSection instanceof HTMLElement)) {
       return;
@@ -162,13 +172,21 @@ export class ProfileWalletController {
           return;
         }
         this.setSyncStatus("Encrypting and publishing…");
-        const result = await sync.enable(pubkey);
+        const result = await sync.enable(pubkey, {
+          confirmOverwrite: () => this.confirmSyncOverwrite(),
+        });
         if (result?.ok) {
           this.setSyncStatus(
             `Synced to ${result.accepted}/${result.total} relays.`,
             "success"
           );
           this.mainController.showSuccess("Wallet connection synced (encrypted).");
+        } else if (result?.conflict) {
+          // User declined to overwrite a newer copy from another device. Keep
+          // sync on (flag set) and the newer remote intact.
+          this.setSyncStatus(
+            "Kept the newer copy on your account. Use Restore to pull it, or save again to overwrite.",
+          );
         } else {
           if (this.walletSyncToggle instanceof HTMLInputElement) {
             this.walletSyncToggle.checked = false;
@@ -614,11 +632,19 @@ export class ProfileWalletController {
         finalVariant = "success";
         this.mainController.showSuccess("Wallet settings saved.");
         context.reason = "saved";
-        // Keep the encrypted synced copy current if the user opted in.
+        // Keep the encrypted synced copy current if the user opted in. Warn
+        // before overwriting a newer copy changed on another device.
         const sync = this.getWalletSyncService();
         if (sync.isEnabled(normalizedActive)) {
           try {
-            await sync.push(normalizedActive);
+            const syncResult = await sync.push(normalizedActive, {
+              confirmOverwrite: () => this.confirmSyncOverwrite(),
+            });
+            if (syncResult?.conflict) {
+              this.setSyncStatus(
+                "Synced copy on your account is newer — not overwritten.",
+              );
+            }
           } catch (syncError) {
             devLogger.warn(
               "[ProfileModal] Wallet re-sync after save failed:",