Fix 403 errors when opening valid chat rooms

[smshagor-dev]

Summary

Fixes false 403 responses triggered by auxiliary room requests when opening a valid chat, while also adding an explicit authorization guard to the main room-message endpoint.

Root cause

Several room APIs trusted only inbox.ownersId. Group/channel membership is canonically stored in participantsId, so legacy or stale inbox ownership could reject a valid member with 403. Opening a room triggers pins, drafts, topics/E2EE requests, which made the browser report Failed to load resource: 403 even for an accessible room.

Fix

• Add a shared authenticated roomAccess middleware.
• Private rooms remain owner-only.
• Group/channel rooms fall back to canonical participantsId membership.
• When a valid participant is missing from inbox.ownersId, repair the inbox membership before existing controller checks continue.
• Guard GET /chats/:roomId so authenticated non-members cannot fetch room history by guessing a room ID.
• Apply the same guard to pins, drafts, mention suggestions, topics and room E2EE endpoints.
• Add the new middleware to the backend syntax-check build.

Scope

Backend access-control and membership consistency only. No message format, Socket.IO, call, UI, E2EE cryptography, or routing behavior is removed.

[vercel]

Deployment failed for project syncchat with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/smshagor-devs-projects?upgradeToPro=build-rate-limit