Implement read-receipt-service for field decryption events

Create lib/services/read_receipt_service.dart. The class ReadReceiptService takes a SupabaseClient in its constructor for dependency injection. The public method signature: `Future recordReadReceipt({required String contactId, required String fieldName})`. Inside, call `_supabase.rpc('rpc_record_read_receipt', params: {'p_contact_id': contactId, 'p_field_name': fieldName})` and wrap in try/catch for PostgrestException and generic Exception.

Use dart:io Platform.isIOS to set device_platform — pass it as a third RPC param. The Supabase RPC definition (SQL): `CREATE OR REPLACE FUNCTION rpc_record_read_receipt(p_contact_id uuid, p_field_name text, p_platform text) RETURNS void LANGUAGE plpgsql SECURITY DEFINER AS $$ BEGIN INSERT INTO read_receipts(user_id, contact_id, field_name, device_platform) VALUES (auth.uid(), p_contact_id, p_field_name, p_platform); END; $$;`. Register the service in your DI container (Riverpod provider or BLoC service locator) so EncryptedFieldDisplay can call it without tight coupling.

Unit tests (flutter_test + mockito): mock SupabaseClient.rpc() to return success and verify ReadReceiptSuccess is returned; mock to throw PostgrestException and verify ReadReceiptFailure is returned; verify that no second call is made on failure (no retry logic). Integration test (optional, requires Supabase test instance): call recordReadReceipt with a seeded authenticated user, then query read_receipts and assert exactly one row exists with correct contact_id and field_name. RLS test: attempt insert as unauthenticated user and assert permission denied. Target 90% line coverage of the service class.