Implement E2EE and message content moderation

CLAUDE.md

@@ -176,3 +176,40 @@ backgroundColor: 'rgba(18, 18, 18, 0.85)',
 The `BlurView` in `tabBarBackground` is unreliable and can fail during re-renders/transitions, causing a fully transparent tab bar. The solid rgba background acts as a fallback while still allowing the blur effect on top.
 
 **Location:** `apps/mobile/app/(app)/_layout.tsx` - `tabBarStyle`
+
+## E2EE (End-to-End Encryption) Implementation
+
+Chat messages (text, images, videos) are encrypted client-side using AES-256-GCM with triple-wrapped RSA keys.
+
+### Architecture
+- **Full documentation:** See `docs/e2ee-implementation.md` for complete details
+- **Encryption library:** `apps/mobile/src/lib/encryption/`
+- **React hooks:** `apps/mobile/src/hooks/useEncryptionKeys.ts`, `useDecryptedMessage.ts`
+- **Edge functions:** `handle-key-rotation`, `reencrypt-pending-messages`
+
+### Key Concepts
+1. **Message versions:** v1 = plaintext (legacy), v2 = E2EE
+2. **Triple-wrapped keys:** Each message's AES key is RSA-encrypted for sender, recipient, and admin
+3. **Device recovery:** When user gets new device, admin key re-wraps messages for new user key
+
+### Database Tables
+- `messages.version` - Encryption version (1 or 2)
+- `messages.encrypted_content` - Base64 ciphertext
+- `messages.encryption_iv` - Base64 IV for AES-GCM
+- `messages.keys_metadata` - JSONB with wrapped keys
+- `profiles.public_key_jwk` - User's RSA public key
+- `master_keys` - Admin RSA public keys
+
+### Setup Required
+1. Run `node scripts/generate-admin-keys.mjs` to generate admin keypair
+2. Insert public key into `master_keys` table
+3. Store private key in `ADMIN_PRIVATE_KEY_JWK` environment variable for edge functions
+4. Install crypto dependency: `npm install react-native-quick-crypto@^0.7.x`
+5. Run `npx expo prebuild --clean` after installation
+
+### Edge Functions for E2EE
+| Function | verify_jwt | Purpose |
+|----------|------------|---------|
+| `handle-key-rotation` | false | Re-wraps message keys when user gets new device |
+| `reencrypt-pending-messages` | false | Wraps keys for recipient after they generate keys |
+