feat: verify embedded backup media checksums

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/application/ports.dart

@@ -200,6 +200,7 @@ final class EmbeddedBackupMediaFile {
     required this.fileName,
     required this.mimeType,
     required this.sizeBytes,
+    required this.sha256,
     required this.base64,
   });
 
@@ -208,6 +209,7 @@ final class EmbeddedBackupMediaFile {
   final String fileName;
   final String? mimeType;
   final int sizeBytes;
+  final String sha256;
   final String base64;
 }
 

lib/application/use_cases.dart

@@ -4900,6 +4900,7 @@ Map<String, Object?> _mediaFileToJson(EmbeddedBackupMediaFile file) => {
   'fileName': file.fileName,
   'mimeType': file.mimeType,
   'sizeBytes': file.sizeBytes,
+  'sha256': file.sha256,
   'base64': file.base64,
 };
 
@@ -4949,6 +4950,7 @@ List<EmbeddedBackupMediaFile> _mediaFilesFromBackup(Object? value) {
           fileName: _stringFromBackup(payload, 'fileName'),
           mimeType: payload['mimeType'] as String?,
           sizeBytes: payload['sizeBytes'] as int? ?? 0,
+          sha256: _stringFromBackup(payload, 'sha256'),
           base64: _stringFromBackup(payload, 'base64'),
         );
       })