fix(privacy): what the app shows and adds keeps private studysets private (ADR 0019)

The reading of 22 Oct, on the device's side. Private cards never move
into a readable studyset: the card browser asks to make it private first.
Locked studysets are left out of the move sheets and the destinations
words are added to. A studyset whose key isn't on this device says to
sign in with the password here, not that it is lost, and can still be
archived; creating one there says why it can't. The marker shows the lock
for a private studyset published before, and a shield with a warning
while something in it is still readable or unsealed, with Finish in its
dialog. The library's offer covers every top-level studyset, Recently
deleted and orphaned ones too, says what couldn't be sealed, and its
answer follows the person in their settings (schema 11).

The full-window editors carry the studyset they were opened from, and an
account with keys adds no file where none is known (a new studyset's
description takes pictures once it is made). A file no live row names is
never uploaded, and deleting a row clears what it owed. Sealed rows are
indexed by key and hash. A suggestion from a private copy uploads
readable copies of its files for the author; accepting swaps whole
`asset:` values only.

Docs: ADR 0019's "The reading (22 Oct 2026)" with the decisions, what
changed and the residual risks; "As built" and Learn's AGENTS.md brought
up to date.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_flutter/lib/l10n/app_en.arb

@@ -1337,6 +1337,7 @@
       "megabytes": {"type": "int"}
     }
   },
+  "fileAfterCreate": "Pictures and sounds can be added once the studyset is made.",
   "fileNotKept": "The file couldn't be kept on this device.",
   "fileRemoveImage": "Remove image",
   "fileRemoveSound": "Remove sound",
@@ -2438,9 +2439,18 @@
   "studysetReadableBody": "Everything in it is decrypted and synced again, so the instance can read it: you can publish it, and Claude can read it through the connector.",
   "studysetPrivateNoKeys": "Sign in with your password on this device to make studysets private.",
   "studysetPrivateSomeLocked": "Some of it couldn't be opened on this device and stayed as it was.",
-  "studysetPrivateLabel": "Private",
   "studysetLockedTitle": "Locked",
   "studysetLockedBody": "This studyset is private, and its key doesn't open on this device: it was encrypted with keys your account no longer has. It can only be deleted.",
+  "studysetVisibilityPartly": "Private, partly readable",
+  "studysetPrivacyPartlyBody": "Some of it is still readable by the instance: what a device wrote before it heard, or files not moved yet. It is sealed as soon as a device with your keys can, or now with Finish.",
+  "studysetPrivacyFinish": "Finish",
+  "studysetLockedNoKeysBody": "This studyset is private, and its key isn't on this device. Sign in with your password on this device to open it.",
+  "cardMovePrivateTitle": "Make “{title}” private?",
+  "@cardMovePrivateTitle": {"placeholders": {"title": {"type": "String"}}},
+  "cardMovePrivateBody": "These flashcards are private. “{title}” is readable by the instance, so they can only move there once it is private too.",
+  "@cardMovePrivateBody": {"placeholders": {"title": {"type": "String"}}},
+  "cardMovePrivateAction": "Make private and move",
+  "privacyKeysMissing": "Sign in with your password on this device: what you add or change here would be private.",
   "libraryOfferPrivateTitle": "Make your studysets private?",
   "libraryOfferPrivateBody": "New studysets are private: end-to-end encrypted, so only your devices can read them. Those you made before stay readable by the instance until you make them private too. Copies in the instance's backups stay readable until those expire.",
   "libraryOfferPrivateAction": "Make all private",