Svet Črnil Pomoč 2.0.3 (20003) — automatic same-device recovery

Install as an update of si.svetcrnil.pomoc, using the original release certificate.
The customer taps Obnovi. No recovery code is entered. The app obtains its native
RustDesk ID and proves possession of that device's native Ed25519 identity.
The server restores the single unfinished paid Android request for that ID.
The existing payment, request, conversation, attempt, fence and checkpoint remain.
Mandatory Android sharing/accessibility permissions are still approved by the user.

Identity verification
New/authenticated sessions pin their public native key. Legacy sessions obtain a
broker-signed IdPk certificate for their own ID, verified against the existing
private broker's public root. The certificate request never follows the returned
peer/relay address or opens a screen/input session. Local key material is read
only inside the app sandbox and is never transmitted. The client signs a bounded,
domain-separated, expiring server challenge; the server rotates the app bearer
atomically. Durable retry identity handles a lost response without another order.
Pending/unknown actions and operator review are never automatically replayed.

Rebuild with the toolchain in SC_ANDROID_BUILD_V2.md, plus cryptography 2.7.0:
flutter build apk --release --no-pub --build-name=2.0.3 --build-number=20003 --target-platform=android-arm,android-arm64,android-x64
The original RustDesk/C++ libraries for three ABIs are unchanged from 2.0.2.

Verification
All five Dart contract suites passed, including the new native signature,
broker certificate, same-session, lost-response and consent-gate checks.
Targeted Dart analysis found no errors or warnings (style infos only).
The matching backend passed all 35 Python tests.
Actual Android/HyperOS permissions and a live tablet recovery still require
verification on that device; automated tests do not establish that outcome.

Regression surface compared with 2.0.2
- svetcrnil_commercial_page.dart: the recovery button no longer opens code entry;
  it reads native identity, completes proof and resumes the existing permissions
  flow. Authenticated registration adds optional public-key enrollment.
- svetcrnil_commercial_api.dart: a parallel automatic recovery entry point keeps
  pending recovery durable and adds optional key enrollment to register/resume.
  Existing order, payment, cancellation and legacy-code paths are retained.
- pubspec.yaml/lock: one pinned cryptography dependency for native Ed25519 proof.
- SC_package_source_v2.py: version/provenance and required new source/tests.
New feature implementation: svetcrnil_native_recovery.dart.
Server changes: service.py thin routing/enrollment/health hooks, new
native_recovery.py, and two additional customer routes in asistenca-v2-api.php.
No worker, payment provider, fiscal, server setting or global RustDesk changes.
A 100-percent coupon is not implemented by this release.
