feat(messages): add pinned channel messages

[hmans]

Why

Channel members need a durable place for announcements, decisions, and other useful messages without copying their content elsewhere. Room managers should be able to curate that list with the existing room-management authority, while message edits, retractions, room access, and mixed client/server versions remain safe.

Closes #1982.

What changed

• Added channel-only pin and unpin facts, current pin state in the Room Timeline projection and snapshot, and authorization-fenced manager commands. Pin mutations require both current membership and effective room.manage; archived rooms reject changes.
• Added additive RoomService list/create/delete RPCs and exposed canonical pin state on the existing Message resource, so timeline, singular message, and BatchGetMessages responses share one authoritative shape.
• Hydrated pin-list responses through a focused assembler with request-scoped decryption caching, batched reactions, and bounded concurrent message work. Related message authors and participants are resolved by ID through the canonical batched user API and shared client cache.
• Delivered pin changes through the existing server_state_upsert realtime operation. The retained client store refreshes canonical resources, applies message edits immediately, removes retractions, and scrubs content on access loss or room eviction.
• Added a channel Pins sidebar with automatic pagination, the exact canonical room-message component without truncation, whole-message navigation, normal message actions, retry states, and a device-local unseen dot on the header pin icon.
• Ordered pins by durable event sequence and returned a stable opaque latest-pin marker that survives unpins, avoiding replica-clock ordering errors and offline-unpin false positives without exposing a pin-operation identity or storage coordinates.
• Added complete localized copy, the Pinned Messages feature record, architecture inventory updates, a user guide, generated API reference updates, and the 0.5.0 release-note entry.

Compatibility and security

• Classification: additive public API, realtime, persisted-event, and disposable-snapshot changes; no breaking fields or migration are introduced.
• Older clients continue to understand server_state_upsert and ignore its unknown nested pin field. Newer clients gate pinned messages at server version 0.5.0-0, so they do not call the new RPCs on older servers.
• Pin writes use room and authorization OCC fences. Nonmembers, direct-message participants, callers without room.manage, and managers of archived rooms cannot mutate pins. Client plaintext mirrors are reset on authorization loss, room removal, projection reset, and realtime-retention eviction.
• Pin mutations and realtime changes update the retained room store immediately; late mutation responses are epoch-fenced, and only an explicit positive access grant reopens the store.
• Device-local seen markers are scoped to the authenticated viewer and purged on room access loss, preventing both room-sensitive persistence and cross-account state inheritance.
• Room Timeline diagnostics account for both active-pin and latest-pin indexes so operational memory estimates remain complete.

Test plan

• mise codegen-proto
• mise test-cli
• mise test-frontend
• mise lint
• mise license-check
• git diff --check
• Chrome DevTools MCP: confirmed BatchGetMessages returns authoritative pinned state; a freshly hydrated row showed Unpin; unpinning immediately changed the action to Pin; re-pinning restored the fixture; and the network contained normal message hydration plus list/create/delete pin calls with no pin-specific batch endpoint. A stable reload reported no console warnings or errors in DevTools.