Sign plaintext packets in licensed mode (#10969)

* feat: sign licensed plaintext packets

Preserve and publish identity keys in licensed mode so existing XEdDSA signatures can authenticate plaintext traffic. Sign licensed broadcasts and direct messages when they fit, while keeping PKI encryption disabled and normal routing behavior unchanged.

* fix(security): persist licensed channel sanitation

* fix(security): close licensed migration lifecycle gaps

* fix(security): address licensed signing review feedback

* test: restore signing globals from Unity teardown

* fix(baseui): allow confirmed ham region selection

* fix(baseui): guard region picker validation

* style: trunk fmt

---------

Co-authored-by: Ben Meadors <benmmeadors@gmail.com>
Co-authored-by: Austin <vidplace7@gmail.com>

src/modules/AdminModule.h

@@ -40,6 +40,9 @@ class AdminModule : public ProtobufModule<meshtastic_AdminMessage>, public Obser
 
   private:
     bool hasOpenEditTransaction = false;
+#ifdef PIO_UNIT_TESTING
+    int lastSaveWhatForTest = 0;
+#endif
 
     uint8_t session_passkey[8] = {0};
     uint32_t session_time = 0;        // millis() when the current session passkey was issued
@@ -155,9 +158,12 @@ class AdminModule : public ProtobufModule<meshtastic_AdminMessage>, public Obser
 static constexpr const char *licensedModeMessage =
     "Licensed mode activated, removing admin channel and encryption from all channels";
 
+static constexpr const char *licensedIdentityMigrationMessage =
+    "Licensed signing requires an identity key; this node identity will change after key generation";
+
 static constexpr const char *publicChannelPrecisionMessage =
     "Precise position is not allowed on a public (open / known-key) channel; reduced to coarse precision";
 
 extern AdminModule *adminModule;
 
-void disableBluetooth();
+void disableBluetooth();