feat: add private messaging channels

[llbbl]

Summary

Closes #128

Adds public channels and two-person direct messages while preserving the legacy global stream as #general. Existing messages are safely backfilled, channel membership is authenticated, WebSocket delivery is scoped to members, and Vue/Svelte clients support channel and DM navigation with unread state.

Changes

• Adds cross-database channels, memberships, message linkage, and #general backfill migration.
• Adds channel listing/creation/join/leave, creator controls, channel message, and idempotent DM APIs.
• Adds authenticated WebSocket subscriptions, member-only delivery, unread events, and reconnect handling.
• Adds accessible Vue and Svelte channel/DM sidebars with URL state and legacy-client compatibility.
• Documents the channel model, migration/backfill, and MySQL locking considerations.

Validation

• composer test:all: PASS (215 tests, 815 assertions)
• composer test:integration:websocket: PASS (7 tests, 60 assertions)
• composer analyse: PASS
• composer cs-check: PASS
• pnpm check: PASS
• pnpm build: PASS
• Focused Playwright Vue/Svelte scenarios: PASS (6/6)
• Independent PHP review: PASS
• Independent Vue/JavaScript review: PASS
• Independent Svelte review: PASS

Mutation testing was not run; it remains manual-only per project workflow.