fix: ncd handle UAF in topo_recovery and topo_group_invite callbacks

topo_recovery_callback: detach cb on UP handoff and close handle on
DOWN/TIMEOUT so no handle with cb_arg==ctx outlives ctx (ASAN
heap-buffer-overflow in topo_recovery_callback).

tgi_to_channel_cb: force_close handle on NCD_EVENT_TIMEOUT so a late UP
cannot fire into the freed tgi_conn_ctx.

Also: android chatgui reverseLayout scroll + msg order/stable pagination.

src/routing_layer/topo_group_invite.c

@@ -517,6 +517,7 @@ static void tgi_to_channel_cb(struct NODE_CONN_DIRECT* h, enum ncd_event ev, voi
         node_conn_direct_set_callback(h, NULL, NULL);
         u_free(c);
     } else if (ev == NCD_EVENT_TIMEOUT) {
+        node_conn_direct_force_close(h);
         u_free(c);
     }
 }

src/routing_layer/topo_recovery.c

@@ -65,14 +65,17 @@ static void topo_recovery_callback(struct NODE_CONN_DIRECT* h, enum ncd_event ev
     if (ctx->connect_timer) { uasync_cancel_timeout(ctx->instance->ua, ctx->connect_timer); ctx->connect_timer = NULL; }
     for (size_t i = 0; i < ctx->count; i++)
         if (ctx->nodes[i].node_id == node_id) { ctx->nodes[i] = ctx->nodes[ctx->count - 1]; ctx->count--; break; }
+    ctx->current_node_id = 0;
+    ctx->current_handle = NULL;
     if (event == NCD_EVENT_UP) {
         struct TOPO_GROUP_NODE* nq = topo_node_find_by_id(ctx->group, node_id);
         if (nq) nq->handle = h;
+        node_conn_direct_set_callback(h, NULL, NULL);
         DEBUG_INFO(DEBUG_CATEGORY_BGP, "recovery: next=%016llx reconnected to %016llx", (unsigned long long)ctx->next_hop_id, (unsigned long long)node_id);
     } else {
+        node_conn_direct_close(h);
         DEBUG_INFO(DEBUG_CATEGORY_BGP, "recovery: next=%016llx connect to %016llx failed: %d", (unsigned long long)ctx->next_hop_id, (unsigned long long)node_id, event);
     }
-    ctx->current_node_id = 0;
     topo_recovery_try_next(ctx);
 }