feat(client-federation): user-view cache for cross-instance DM render

Fixes a render bug where a federated user (e.g. axel@nova) appeared with
the federation globe icon and a broken avatar when viewed on his own home
instance. Root cause: `populateFromReady` is first-wins by federatedId and
discards the entire skipped DM payload — including its `members` array —
so when a sibling instance's ready arrived first, the home instance's view
of every shared user was dropped on the floor.

Adds a render-only `userViews` cache that mirrors the `dmAlternatives`
philosophy: information from skipped ready payloads is preserved for
rendering. Every wire surface that delivers a User upserts into the cache
regardless of dedup outcome; render sites read through a Zustand selector
hook to surface the home view when one is loaded. The DM channel ingestion
race is left untouched — the existing no-flapping invariant on origin
reconnect is intentional and load-bearing for failover.

Layered changes:

- `identity.ts`: `normalizeOriginToHost`, `canonicalUserKey`,
  `isDeliveryFromHome`, `isFederationGlobeApplicable` — single helpers
  for origin/host normalization and the home/stub tier decision.
- `spaceStore.ts`: `userViews` Map, `UserViewEntry` type, `upsertUserView`
  action with the home-wins preference rule, prune by `deliveredBy` in
  `removeInstanceSpaces` (mirrors `dmAlternatives` cleanup), `reset`
  clears.
- `userViewLookup.ts`: `useCanonicalUserView` (Zustand selector hook for
  React) + `getCanonicalUserView` (sync getter for non-React paths).
  Render reactivity is structural via the selector, not coincidence on
  legacy update paths.
- `populateFromReady` upsert pass runs BEFORE the federatedId dedup so
  members of skipped DMs still reach the cache.
- WS handlers (dm_message_*, message_*, user_updated, member_joined,
  friend_request_*, dm_channel_created, dm_member_added) and REST
  hydrators (socialStore, discoverStore, mutuals) feed the cache with
  their delivering origin.
- Render-site routing through `useCanonicalUserView` at every audited
  user-rendering site (sidebar, header, search, message bubble, reply
  chips, profile popout/modal, group settings, voice tiles, mention
  chips, member lists, friends, invites). Self-rendering sites compose
  alongside via existing `isSelf`/`resolveDisplayIdentity`.
- Globe predicate hoisted to `isFederationGlobeApplicable` and applied
  at three sites, gating on `domain !== window.location.host` so we
  never show the globe for users whose home IS our own.

Tests: 31 new unit tests across `identity`, `userViews` store, and
`userViewLookup`. Full suite 276/276.

Docs: `client-federation.md` §3 gains a "User View Cache" section
parallel to "DM Origin Failover"; `dm-system.md` notes the new store
action and WS handler upserts.

Bug 3 (federation profile-sync gap — orbit's stale profile data on
nova-Axel after a clear/color-change on nova never propagated)
remains open. The user-view cache routes around it for the common case
(home instance is connected), but the underlying S2S relay gap is its
own diagnosis and follows in a separate branch.

packages/web/src/components/modals/TransferOwnershipModal.tsx

@@ -5,8 +5,44 @@ import { useSpaceStore, getApiForOrigin, type TaggedSpace } from '../../stores/s
 import { useAuthStore } from '../../stores/authStore';
 import { useUIStore } from '../../stores/uiStore';
 import { normalizeUserAssets } from '../../utils/assetUrls';
+import { useCanonicalUserView } from '../../utils/userViewLookup';
 import { Avatar } from '../ui/Avatar';
 
+function TransferMemberRow({
+  member,
+  onSelect,
+}: {
+  member: MemberWithUser;
+  onSelect: (userId: string) => void;
+}) {
+  const canonical = useCanonicalUserView(member.user);
+  const displayName = canonical.displayName || canonical.username;
+  return (
+    <button
+      onClick={() => onSelect(member.userId)}
+      className="w-full flex items-center gap-2.5 px-2.5 py-1.5 rounded-md hover:bg-white/[0.06] transition-colors"
+    >
+      <Avatar
+        src={canonical.avatar}
+        name={displayName}
+        size={32}
+        user={canonical}
+        userId={member.userId}
+      />
+      <div className="flex flex-col items-start min-w-0">
+        <span className="text-sm text-txt-primary truncate max-w-full">
+          {displayName}
+        </span>
+        {canonical.displayName && (
+          <span className="text-[11px] text-txt-tertiary truncate max-w-full">
+            {canonical.username}
+          </span>
+        )}
+      </div>
+    </button>
+  );
+}
+
 export function TransferOwnershipModal({ spaceId, onClose }: { spaceId: string; onClose: () => void }) {
   const modalRef = useRef<HTMLDivElement>(null);
   const space = useSpaceStore((s) => s.spaces.find(sp => sp.id === spaceId));
@@ -29,8 +65,9 @@ export function TransferOwnershipModal({ spaceId, onClose }: { spaceId: string;
         const client = getApiForOrigin(origin);
         const fetched = await client.spaces.members(spaceId);
         if (cancelled) return;
-        if (origin) {
-          for (const m of fetched) normalizeUserAssets(m.user, origin);
+        for (const m of fetched) {
+          if (origin) normalizeUserAssets(m.user, origin);
+          useSpaceStore.getState().upsertUserView(m.user, origin);
         }
         setMembers(fetched);
       } catch {
@@ -156,33 +193,13 @@ export function TransferOwnershipModal({ spaceId, onClose }: { spaceId: string;
               ) : filteredMembers.length === 0 ? (
                 <p className="text-xs text-txt-tertiary text-center py-4">No members found</p>
               ) : (
-                filteredMembers.map((member) => {
-                  return (
-                    <button
-                      key={member.userId}
-                      onClick={() => setSelectedUserId(member.userId)}
-                      className="w-full flex items-center gap-2.5 px-2.5 py-1.5 rounded-md hover:bg-white/[0.06] transition-colors"
-                    >
-                      <Avatar
-                        src={member.user.avatar}
-                        name={member.user.displayName || member.user.username}
-                        size={32}
-                        user={member.user}
-                        userId={member.userId}
-                      />
-                      <div className="flex flex-col items-start min-w-0">
-                        <span className="text-sm text-txt-primary truncate max-w-full">
-                          {member.user.displayName || member.user.username}
-                        </span>
-                        {member.user.displayName && (
-                          <span className="text-[11px] text-txt-tertiary truncate max-w-full">
-                            {member.user.username}
-                          </span>
-                        )}
-                      </div>
-                    </button>
-                  );
-                })
+                filteredMembers.map((member) => (
+                  <TransferMemberRow
+                    key={member.userId}
+                    member={member}
+                    onSelect={setSelectedUserId}
+                  />
+                ))
               )}
             </div>
           </>