feat(client-federation): user-view cache for cross-instance DM render

Fixes a render bug where a federated user (e.g. axel@nova) appeared with
the federation globe icon and a broken avatar when viewed on his own home
instance. Root cause: `populateFromReady` is first-wins by federatedId and
discards the entire skipped DM payload — including its `members` array —
so when a sibling instance's ready arrived first, the home instance's view
of every shared user was dropped on the floor.

Adds a render-only `userViews` cache that mirrors the `dmAlternatives`
philosophy: information from skipped ready payloads is preserved for
rendering. Every wire surface that delivers a User upserts into the cache
regardless of dedup outcome; render sites read through a Zustand selector
hook to surface the home view when one is loaded. The DM channel ingestion
race is left untouched — the existing no-flapping invariant on origin
reconnect is intentional and load-bearing for failover.

Layered changes:

- `identity.ts`: `normalizeOriginToHost`, `canonicalUserKey`,
  `isDeliveryFromHome`, `isFederationGlobeApplicable` — single helpers
  for origin/host normalization and the home/stub tier decision.
- `spaceStore.ts`: `userViews` Map, `UserViewEntry` type, `upsertUserView`
  action with the home-wins preference rule, prune by `deliveredBy` in
  `removeInstanceSpaces` (mirrors `dmAlternatives` cleanup), `reset`
  clears.
- `userViewLookup.ts`: `useCanonicalUserView` (Zustand selector hook for
  React) + `getCanonicalUserView` (sync getter for non-React paths).
  Render reactivity is structural via the selector, not coincidence on
  legacy update paths.
- `populateFromReady` upsert pass runs BEFORE the federatedId dedup so
  members of skipped DMs still reach the cache.
- WS handlers (dm_message_*, message_*, user_updated, member_joined,
  friend_request_*, dm_channel_created, dm_member_added) and REST
  hydrators (socialStore, discoverStore, mutuals) feed the cache with
  their delivering origin.
- Render-site routing through `useCanonicalUserView` at every audited
  user-rendering site (sidebar, header, search, message bubble, reply
  chips, profile popout/modal, group settings, voice tiles, mention
  chips, member lists, friends, invites). Self-rendering sites compose
  alongside via existing `isSelf`/`resolveDisplayIdentity`.
- Globe predicate hoisted to `isFederationGlobeApplicable` and applied
  at three sites, gating on `domain !== window.location.host` so we
  never show the globe for users whose home IS our own.

Tests: 31 new unit tests across `identity`, `userViews` store, and
`userViewLookup`. Full suite 276/276.

Docs: `client-federation.md` §3 gains a "User View Cache" section
parallel to "DM Origin Failover"; `dm-system.md` notes the new store
action and WS handler upserts.

Bug 3 (federation profile-sync gap — orbit's stale profile data on
nova-Axel after a clear/color-change on nova never propagated)
remains open. The user-view cache routes around it for the common case
(home instance is connected), but the underlying S2S relay gap is its
own diagnosis and follows in a separate branch.

packages/web/src/stores/socialStore.ts

@@ -81,6 +81,10 @@ export const useSocialStore = create<SocialState>((set, get) => ({
       // Wait for all remote connections to establish before fanning out
       await waitForAutoConnect();
 
+      // Lazy import — avoids pulling spaceStore's transitive chain (voiceStore →
+      // AudioManager) into test environments that mock only instanceStore.
+      const { useSpaceStore } = await import('./spaceStore');
+
       const instances = useInstanceStore.getState().instances;
       const connectedInstances = instances.filter(i => i.status === 'connected');
 
@@ -113,6 +117,9 @@ export const useSocialStore = create<SocialState>((set, get) => ({
             if (isNative) {
               if (origin) normalizeUserAssets(friend, origin);
               allFriends[existingIdx] = { ...friend, _instanceOrigin: origin };
+              // Upsert the upgraded (native) view into the userViews cache.
+              // Friend carries all identity/avatar fields the cache needs.
+              useSpaceStore.getState().upsertUserView(friend as unknown as User, origin);
             }
             continue;
           }
@@ -120,6 +127,7 @@ export const useSocialStore = create<SocialState>((set, get) => ({
           seen.set(canonicalId, allFriends.length);
           if (origin) normalizeUserAssets(friend, origin);
           allFriends.push({ ...friend, _instanceOrigin: origin });
+          useSpaceStore.getState().upsertUserView(friend as unknown as User, origin);
         }
       }
 
@@ -139,6 +147,9 @@ export const useSocialStore = create<SocialState>((set, get) => ({
       // Wait for all remote connections to establish before fanning out
       await waitForAutoConnect();
 
+      // Lazy import — same pattern as loadFriends; avoids AudioManager TDZ in tests.
+      const { useSpaceStore } = await import('./spaceStore');
+
       const instances = useInstanceStore.getState().instances;
       const connectedInstances = instances.filter(i => i.status === 'connected');
 
@@ -172,6 +183,7 @@ export const useSocialStore = create<SocialState>((set, get) => ({
             if (otherIsNativeHere) {
               if (origin && request.user) normalizeUserAssets(request.user, origin);
               allRequests[existingIdx] = { ...request, _instanceOrigin: origin };
+              if (request.user) useSpaceStore.getState().upsertUserView(request.user, origin);
             }
             continue;
           }
@@ -179,6 +191,7 @@ export const useSocialStore = create<SocialState>((set, get) => ({
           if (otherCanonicalId) seen.set(otherCanonicalId, allRequests.length);
           if (origin && request.user) normalizeUserAssets(request.user, origin);
           allRequests.push({ ...request, _instanceOrigin: origin });
+          if (request.user) useSpaceStore.getState().upsertUserView(request.user, origin);
         }
       }
 
@@ -278,6 +291,9 @@ export const useSocialStore = create<SocialState>((set, get) => ({
 
   searchUsers: async (query: string) => {
     try {
+      // Lazy import — avoids AudioManager TDZ in test environments.
+      const { useSpaceStore } = await import('./spaceStore');
+
       const instances = useInstanceStore.getState().instances;
       const connectedInstances = instances.filter(i => i.status === 'connected');
 
@@ -316,6 +332,7 @@ export const useSocialStore = create<SocialState>((set, get) => ({
             if (isNative) {
               if (origin) normalizeUserAssets(user, origin);
               allUsers[existingIdx] = { ...user, _instanceOrigin: origin };
+              useSpaceStore.getState().upsertUserView(user, origin);
             }
             continue;
           }
@@ -323,6 +340,7 @@ export const useSocialStore = create<SocialState>((set, get) => ({
           seen.set(canonicalId, allUsers.length);
           if (origin) normalizeUserAssets(user, origin);
           allUsers.push({ ...user, _instanceOrigin: origin });
+          useSpaceStore.getState().upsertUserView(user, origin);
         }
       });