SecureBit.chat - P2P Encrypted Messenger Files

What's fixed

This patch completes the mandatory receiver-consent gate for incoming file transfers and resolves a callback ownership conflict that caused every incoming file request to be silently auto-rejected.

Bug fixes

Primary (critical): The missing fourth onIncomingFileRequest callback in setFileTransferCallbacks caused handleFileTransferStart to always see null for the consent handler and auto-reject every incoming file silently — before the user could see or respond to the request.

Secondary: FileTransferComponent was independently registering all four callbacks on mount and nulling them on unmount. Hiding the file-transfer panel destroyed the progress, received, and error handlers for the entire session.

Architectural: Both app.jsx and FileTransferComponent were fighting over the same four callback slots, creating a race between mount/unmount cycles.

Changes

• Wired the missing onIncomingFileRequest callback in app.jsx — incoming requests now reach the UI.
• Centralized pendingIncomingFiles state in the root component so consent prompts appear regardless of whether the panel is visible.
• Auto-opens the file-transfer panel when an incoming request arrives.
• Removed independent callback registration from FileTransferComponent; it now receives consent state as props.
• Added getReceivedFileObjectURL / revokeReceivedFileObjectURL on EnhancedSecureWebRTCManager for the panel's download buttons.
• Updated file-transfer-ui-cleanup regression test to match the new single-owner callback architecture.

Security

No change to the cryptographic or transport security model. Sender chunks remain gated behind an explicit file_transfer_response from the receiver — this patch ensures that gate actually reaches the user.

Verification

• All 14 regression tests pass (npm test).
• Clean production build (npm run build).