feat: implement Phase 1 server-side federation groundwork

Add multi-instance support foundation: shared federation types
(ReplicatedInstance, InstanceInfoResponse, VerifyPasswordRequest),
database schema changes (home_instance, replicated_instances on users,
instance_name on settings), public instance info endpoint, auth
registration with homeInstance and username@domain collision fallback,
password verification endpoint, and replicatedInstances sync on user
profile. Extract duplicated sanitizeUser into shared utility across
8 server files.

packages/server/src/ws/events.ts

@@ -5,20 +5,8 @@ import { connectionManager } from './handler.js';
 import type { VoiceRoom, DmRoomMeta, ServerRoomMeta } from './handler.js';
 import { isMember, getChannelServerId, isDmMember, hasPermission, PermissionBits } from '../utils/permissions.js';
 import { broadcastDmMessage, getDmMessageWithUser } from '../routes/dm.js';
-import type { User, MessageWithUser, Attachment, DmMessageWithUser } from '@backspace/shared';
-
-function sanitizeUser(row: typeof schema.users.$inferSelect): User {
-  return {
-    id: row.id,
-    username: row.username,
-    displayName: row.displayName,
-    avatar: row.avatar,
-    status: (row.status ?? 'offline') as User['status'],
-    customStatus: row.customStatus,
-    isAdmin: row.isAdmin === 1,
-    createdAt: row.createdAt,
-  };
-}
+import type { MessageWithUser, Attachment, DmMessageWithUser } from '@backspace/shared';
+import { sanitizeUser } from '../utils/sanitize.js';
 
 function getMessageWithUser(messageId: string): MessageWithUser | null {
   const db = getDb();

packages/server/src/ws/handler.ts

@@ -16,6 +16,7 @@ import type {
   ReadState,
   ActiveCallInfo,
 } from '@backspace/shared';
+import { sanitizeUser } from '../utils/sanitize.js';
 
 // SQLite's SQLITE_MAX_VARIABLE_NUMBER default is 999.
 // Chunk inArray() calls to stay safely under this limit.
@@ -30,19 +31,6 @@ function batchInArray<TId, TResult>(ids: TId[], queryFn: (chunk: TId[]) => TResu
   return results;
 }
 
-function sanitizeUser(row: typeof schema.users.$inferSelect): User {
-  return {
-    id: row.id,
-    username: row.username,
-    displayName: row.displayName,
-    avatar: row.avatar,
-    status: (row.status ?? 'offline') as User['status'],
-    customStatus: row.customStatus,
-    isAdmin: row.isAdmin === 1,
-    createdAt: row.createdAt,
-  };
-}
-
 export interface AuthenticatedSocket {
   ws: WebSocket;
   userId: string;