fix(send): correct group phash and mark full SKDM target set (WA Web parity) - #678

…parity)

Three related group-SKDM correctness fixes, the phash ones validated against a
real WA Web capture sent to the production server (raw identifiers redacted as
PII; reproduced locally to confirm the formula).

1. phash base64: use standard alphabet ('+'/'/', `BASE64_STANDARD_NO_PAD`) to
   match whatsmeow (`RawStdEncoding`) and WA Web (`WABase64.encodeB64`). URL-safe
   ('-'/'_') diverged on ~22% of phashes (any output hitting base64 index 62/63).

2. has_key marks the FULL SKDM target set: `PreparedGroupStanza.skdm_devices`
   now carries the whole `distribution_list`, not just the devices that
   encrypted successfully. Mirrors WA Web `markHasSenderKey(x, M)`. Previously
   devices that failed to encrypt (406 / no bundle) stayed `has_key=false` and
   were re-targeted on every send, re-fetching dead prekeys -> retry storm. The
   retry-receipt path (`mark_forget_sender_key`) repairs any that are actually
   alive and keyless.

3. phash over the full participant device set + the sending device, on EVERY
   group send (matching WA Web `phashV2([].concat(A, [B]))`):
   - was computed over the SKDM target subset only and omitted the self device;
   - was omitted entirely on fully-warm sends (no distribution).
   `resolve_skdm_targets` now returns `(all_devices, needs_skdm)` so the caller
   can pass the full set; `prepare_group_stanza` gains `all_devices_for_phash`
   and computes the phash via `build_group_phash_set` (full set + self,
   hosted-filtered) regardless of whether any SKDM is distributed. Status
   broadcasts keep their prior behavior (group-only change).

Validation against a real WA Web capture (prod server):
- cold send: the recipient `<to>` set plus the sending device reproduced the
  exact on-wire phash; the recipient set alone produced a different hash, so the
  sending device is part of the hashed set.
- two later warm sends (no `<participants>`) still carried a phash, confirming a
  phash is sent on every group send.
- the `<ack class="message">` never echoes a phash, so the server validates it
  silently; a correct phash is what keeps it from triggering a re-fanout.

Tests: a phash device-set test (self inclusion + hosted filtering, fictitious
vectors), and a prepare_group_stanza test proving a device whose SKDM
encryption fails is still marked has_key.

The warm group-send benches (setup_group_send_*, force_skdm=false) called
prepare_group_stanza with all_devices_for_phash=None, so distribution_list
stayed None and no phash was computed. Real warm sends now always compute a
phash (full device set + self), so the bench under-measured that cost.

Pass the participant device set on the warm path (mirroring the real caller,
which supplies the full set when not distributing); the cold/force_skdm path
keeps None and resolves the set itself.