Remove plaintext token field from KeyExchangeInit (Stage 2: stop sending)

[danmarg]

Problem

Follow-up to #308 (Stage 1). Now that Alice ignores the token field in KeyExchangeInit, Bob can stop sending it entirely to close the privacy leak completely.

Change

Stage 2 (this issue): Stop populating token in KeyExchangeInit on the sender (Bob) side.

• Remove token = initMsg.token.toHex() from E2eeManager.processScannedQr
• Remove tokenAliceToBob derivation from KeyExchange.bobProcessQr
• Remove token field from KeyExchangeInitMessage in Types.kt
• Update MailboxMessageTest and any other tests constructing KeyExchangeInitPayload with an explicit token

Prerequisites

Stage 1 (#308) must be deployed. Wire-break risk is zero once all receivers ignore the field.