Build 67: Pay over-balance shake, manual slatepacks, green CI, slimmer builds

Pay: stop reddening the amount while typing — requesting more than you hold is
a valid request, so the digits stay black. Pressing Pay without enough funds
now shakes and briefly flashes the amount red and buzzes the phone, then
settles back. Bigger scan-to-pay puck.

Settings: the username "@" moves inside the field as the "@yourname"
placeholder (a leading "@" the user types is stripped). Mixnet routing is
shortened to "All traffic" and flagged in the privacy color. The Build row
links to GitHub releases. Network reads "MW + Nym mixnet + nostr". The Nym
third-party row shows the linked SDK version instead of "socks5".

Wallet: expose GRIM's native by-hand slatepack flow as an advanced
"Slatepacks" page — paste to receive/pay/finalize, or create a payment
slatepack to hand over. The fallback for when a payment can't ride a @username.

CI: fix the red GitHub builds. nym-sdk is a path dep on ../nym, which the
runners didn't have. A composite action materializes the pinned upstream nym
commit plus Goblin's small Android webpki patch before each build; aws-lc-sys
uses prebuilt NASM on native Windows.

Builds: strip release binaries, dropping ~17 MB of debug symbols from the
desktop build.

.github/actions/fetch-nym/action.yml

@@ -0,0 +1,31 @@
+name: Fetch patched nym SDK
+description: >
+  Materialize the nym workspace at ../nym (sibling of the goblin checkout) so the
+  `nym-sdk = { path = "../nym/sdk/rust/nym-sdk" }` dependency resolves. We pin the
+  exact upstream commit Goblin was built against and apply Goblin's small
+  Android webpki-roots patch on top — no separate nym fork to maintain.
+
+runs:
+  using: composite
+  steps:
+    - name: Clone + patch nym
+      shell: bash
+      run: |
+        set -euo pipefail
+        # Upstream nymtech/nym commit Goblin's Cargo.lock was generated against.
+        NYM_SHA=b6eb391e85be7eb8fca62def6d1ac32fd1108c30
+        DEST="$(dirname "$GITHUB_WORKSPACE")/nym"
+        if [ -e "$DEST/sdk/rust/nym-sdk/Cargo.toml" ]; then
+          echo "nym already present at $DEST"
+          exit 0
+        fi
+        rm -rf "$DEST"
+        mkdir -p "$DEST"
+        cd "$DEST"
+        git init -q
+        git remote add origin https://github.com/nymtech/nym.git
+        # Fetch just the pinned commit (GitHub allows reachable-SHA fetches).
+        git fetch -q --depth 1 origin "$NYM_SHA"
+        git checkout -q FETCH_HEAD
+        git apply --whitespace=nowarn "$GITHUB_WORKSPACE/ci/nym-webpki-android.patch"
+        echo "nym materialized at $DEST ($NYM_SHA + Goblin webpki patch)"