feat(apple): expose device history through the core gateway

Adds contact, pairing, and offer models plus the gateway surface the feature
models will use. Contacts and offers are endpoint-scoped events with no
transfer id, so they get their own coalesced signals.

DeviceContact.displayName prefers the local label over the name the peer
claims, and carries a short endpoint fingerprint for telling apart devices
using the same name.

apple/VniDrop/Core/CoreModels.swift

@@ -168,6 +168,10 @@ enum CoreSignal: Equatable, Sendable {
 	case receiverHistoryChanged(transferId: UInt64)
 	/// Transfer status/history changed enough to re-read the durable snapshot.
 	case transfersChanged(transferId: UInt64)
+	/// Device history changed: a contact was added, forgotten, or blocked.
+	case contactsChanged
+	/// An incoming offer arrived or was answered.
+	case offersChanged
 }
 
 // MARK: - Transfer helpers (ported from AppUiModels.kt)
@@ -186,3 +190,91 @@ extension TransferStatus {
 		self == .done || self == .failed || self == .cancelled
 	}
 }
+
+// MARK: - Device history
+
+/// A device the user has chosen to remember.
+///
+/// `localLabel` is the user's own name for the device and is authoritative for
+/// display; `remoteDisplayName` is whatever the device last called itself and is
+/// untrusted. The endpoint id is the only real identity.
+struct DeviceContact: Equatable, Identifiable, Sendable {
+	let endpointId: String
+	let localLabel: String?
+	let remoteDisplayName: String?
+	let lastTransferAt: Int64?
+	let createdAt: Int64
+	/// Whether a live grant is held. False once the peer revoked, the grant
+	/// lapsed, or the peer reinstalled and lost its identity.
+	let canSend: Bool
+
+	var id: String { endpointId }
+
+	/// Name to show, preferring the local label the peer cannot influence.
+	var displayName: String {
+		if let localLabel, !localLabel.isEmpty { return localLabel }
+		if let remoteDisplayName, !remoteDisplayName.isEmpty { return remoteDisplayName }
+		return String(localized: L10n.Approval.nearbyDevice)
+	}
+
+	/// Short prefix of the endpoint id, for telling apart devices claiming the
+	/// same name.
+	var shortFingerprint: String { String(endpointId.prefix(8)) }
+}
+
+/// A device offering to be remembered, awaiting this user's decision.
+struct PendingPairingModel: Equatable, Identifiable, Sendable {
+	let endpointId: String
+	let displayName: String?
+	let receivedAt: Int64
+
+	var id: String { endpointId }
+
+	var resolvedName: String {
+		guard let displayName, !displayName.isEmpty else {
+			return String(localized: L10n.Approval.nearbyDevice)
+		}
+		return displayName
+	}
+}
+
+/// A transfer a remembered device is offering. Carries no ticket: that is a
+/// capability and the core releases it only once the user accepts.
+struct IncomingOfferModel: Equatable, Identifiable, Sendable {
+	let offerId: String
+	let fromEndpointId: String
+	let senderDisplayName: String?
+	let transferName: String
+	let fileCount: UInt64
+	let totalBytes: UInt64
+	let receivedAt: Int64
+
+	var id: String { offerId }
+
+	var resolvedSenderName: String {
+		guard let senderDisplayName, !senderDisplayName.isEmpty else {
+			return String(localized: L10n.Approval.nearbyDevice)
+		}
+		return senderDisplayName
+	}
+}
+
+/// How long a remembered device stays reachable while unused. The countdown
+/// restarts on every transfer.
+enum GrantLifetimeOption: String, CaseIterable, Identifiable, Sendable {
+	case days30
+	case days90
+	case days365
+	case never
+
+	var id: String { rawValue }
+
+	var days: Int? {
+		switch self {
+		case .days30: return 30
+		case .days90: return 90
+		case .days365: return 365
+		case .never: return nil
+		}
+	}
+}