feat: messaging with conversations, rich text, attachments, typing, unread (phase 9)

- conversations: dm (unique pair, find-or-create), group (titled), project
  (customer-bound); participant-only access
- messages: server-sanitized rich text, attachments referencing uploads
  from the generic POST /api/v1/files endpoint (rate limited, MIME sniffed)
- unread counts via aggregation; mark-read pushes readBy receipts
- chat files served only to conversation participants (or uploader)
- @mentions in chat notify the mentioned participant
- typing indicator: client WS event relayed to other participants
- WS targeted delivery (SendTo) + 15s polling fallback
- two-pane messages UI: conversation list with unread badges, composer
  (contenteditable + formatting buttons), drag & drop upload, inline image
  previews with lightbox, new-conversation dialog with user search

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/http/server.go

@@ -42,9 +42,15 @@ type Server struct {
 	publishFn       func(channel, event string, payload any)
 	enqueueFn       func(ctx context.Context, kind string, payload any) (string, error)
 	wsHandler       func(w http.ResponseWriter, r *http.Request, userID string)
+	sendTo          func(userIDs []string, channel, event string, payload any)
 	performerClient *workperform.Client
 }
 
+// SetSendTo wires targeted hub delivery (chat messages, typing).
+func (s *Server) SetSendTo(f func(userIDs []string, channel, event string, payload any)) {
+	s.sendTo = f
+}
+
 // SetPerformerClient wires the §5.2 client (also feeds the status panel).
 func (s *Server) SetPerformerClient(c *workperform.Client) {
 	s.performerClient = c
@@ -81,6 +87,7 @@ func New(cfg *config.Config, log *slog.Logger, reg *metrics.Registry, st *store.
 	s.routesBoard(mux)
 	s.routesConsultant(mux)
 	s.routesWorkResults(mux)
+	s.routesMessages(mux)
 	mux.HandleFunc("GET /ws", s.handleWS)
 	s.routesWeb(mux)