[llbbl]

Summary

Closes #127

Adds authenticated emoji reactions for messages across the database, HTTP API, WebSocket, Vue, and Svelte clients. Reactions are stored with duplicate protection, rate-limited, broadcast live, and rendered with accessible badges and picker controls.

Changes

• Adds cross-database message_reactions storage with foreign keys, indexes, and uniqueness protection.
• Adds authenticated list/create/delete reaction endpoints with documented payloads and validation.
• Adds rate-limited WebSocket reaction mutations and aggregate broadcasts.
• Adds matching accessible Vue and Svelte reaction badges and emoji pickers.
• Adds integration, WebSocket, browser, and API documentation coverage.

Validation

• composer test: PASS (179 tests, 553 assertions)
• composer test:integration: PASS (28 tests, 172 assertions)
• composer test:integration:websocket: PASS (6 tests, 45 assertions)
• composer analyse: PASS
• composer cs-check -- --sequential: PASS
• composer audit: clean
• pnpm check: PASS
• pnpm build: PASS
• Focused Playwright Vue/Svelte reaction flows: PASS (2 tests)

Mutation testing is manual-only and was not run.