Enforce expected recipient fingerprints and refresh app screenshots

[brainx]

Encryption previously displayed a recipient fingerprint but did not enforce an independently supplied expectation. Add an optional expected fingerprint to single-file, batch, large-file, and CLI encryption. The backend compares it with the actual decoded public key before encryption or output creation, preserving existing behavior when omitted.

• Reject malformed, duplicate, non-text, or mismatching expectations with stable errors. Existing output files remain unchanged on CLI rejection, and rejected jobs publish no result.
• Recheck backend support before protected requests and authentication retries; retain expectations when keys change, and capture one expectation for each batch or job. Fingerprints identify matching keys, not recipient identity.
• Refresh three repository screenshots from real native operations with demonstration files and keys; document reproducible capture. PEM and ciphertext formats are unchanged.

Validation:

• Python suite: 741 passed.
• npm run check: TypeScript, 4 API tests, and 275 unit tests passed; npm run build passed.
• Native browser checks passed for recipient mismatch rejection, single/batch/large-file round trips, key recovery/password changes, and file verification. Captured pages passed accessibility and overflow checks.
• Responsive browser smoke passed at 390, 768, 1024, and 1440 pixels. Python formatting, lint, and type checks passed on affected files.

Local native checks used the existing liboqs 0.15.0 installation with liboqs-python 0.16.0, which emits a version warning. Chromium was selected from an existing local installation via UI_BROWSER_EXECUTABLE.