fix(mobile): clear technical debt — real SHA-256, feed pagination, search

source_hash: BAS JSON import now computes SHA-256 via crypto.subtle.digest
instead of the '${id}-${length}' stub. No extra package — Hermes supports
Web Crypto API natively.

Feed pagination: useActivities(query, limit) accepts a LIMIT parameter.
The feed screen starts at 50, calls loadMore() via FlatList onEndReached
(threshold 0.3) to increment by 50 each time. useActivityCount(query)
drives the hasMore guard so loadMore is a no-op at the end of the list.

Feed search: compact TextInput below the header filters by title via
SQLite json_extract LIKE. Changing the query resets limit to PAGE_SIZE
so stale paginated results don't linger.

Docs: close the three resolved debt items; keep only the accepted
background-polling limitation as a known gap.

mobile/app/(tabs)/import.tsx

@@ -10,6 +10,11 @@ import { extractFile, waitForEngine, onEngineProgress, isEngineAvailable } from
 import { extractFileViaServer, checkServerAuth } from '@/extraction/extractServer';
 import { useTheme } from '@/ThemeContext';
 
+async function sha256hex(text: string): Promise<string> {
+  const buf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+  return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
+}
+
 const FIT_EXTENSIONS   = ['.fit', '.fit.gz'];
 const OTHER_EXTENSIONS = ['.gpx', '.tcx', '.gpx.gz', '.tcx.gz'];
 const ALL_NATIVE_EXTENSIONS = [...FIT_EXTENSIONS, ...OTHER_EXTENSIONS];
@@ -243,7 +248,7 @@ export default function ImportScreen() {
       throw new Error('Not a valid BAS activity JSON (missing id or started_at)');
     }
 
-    const hash    = detail.source_hash ?? `${detail.id}-${text.length}`;
+    const hash    = detail.source_hash ?? await sha256hex(text);
     const origDir = `${FileSystem.documentDirectory}originals/`;
     await FileSystem.makeDirectoryAsync(origDir, { intermediates: true });
     const dest = `${origDir}${detail.id}.json`;