add spam badge for requests

docs/web-of-trust.md

@@ -146,6 +146,13 @@ to be cached, so "mutual contacts" is usually empty) with the registry:
 
 ### Phase 2 — requests list badge
 
+Status: **partially implemented**. Request rooms whose members are all outside
+the web of trust show a `SPAM` badge in the sidebar
+(`Room::is_spam` + `WebOfTrust::is_outside`, rendered in
+`crates/workspace/src/sidebar/rows.rs`; the sidebar subscribes to `WoTEvent` so
+badges update when the graph loads). The mutual-count caption below is still
+open and will follow a different flow.
+
 Where request rooms are rendered, show the mutual count for the sender:
 
 - `crates/workspace/src/sidebar/inbox.rs` (`requests_rows`) and
@@ -162,7 +169,9 @@ flow).
 The payoff: strangers vouched for by the user's contacts can skip screening.
 
 - `pub wot_auto_trust: bool` in `setting_accessors!` in
-  `crates/settings/src/lib.rs` (default `false`) and a "Web of trust" toggle in
+  `crates/settings/src/lib.rs` (enabled out of the box: `Default` is `true` and
+  a `#[serde(default = "default_true")]` fallback covers settings files saved
+  before the field existed) and a "Web of trust" toggle in
   the preferences screen (`crates/workspace/src/dialogs/settings.rs`).
 - The rule lives in one predicate — `Room::auto_trusted(me, cx)` in
   `crates/chat/src/room.rs`: the setting is on and every member other than the