feat: federation batch 1+2 — bug fixes and password enforcement

Batch 1 — Bug fixes:
- Fix stale voice state on remote reconnect (clearVoiceUsersForOrigin)
- Fix logout not cleaning remote servers from store
- Fix reply-to asset normalization for remote messages
- Fix HTTPS hardcoded in autoConnectAll (store full origin, legacy fallback)

Batch 2 — Password enforcement + replication flow:
- Add connectToRemote() with home password verification before remote auth
- Auto-cascade: verify home password → register on remote → login fallback
- Replace Register/Login tabs with single password field in ConnectedInstances
- Add DifferentPasswordError for typed fallback-login UI transition
- Fallback login form shown only when remote has different password

packages/server/src/routes/users.ts

@@ -82,10 +82,13 @@ export async function userRoutes(app: FastifyInstance): Promise<void> {
       if (!Array.isArray(replicatedInstances)) {
         return reply.code(400).send({ error: 'replicatedInstances must be an array', statusCode: 400 });
       }
-      // Validate each entry has domain and username strings
+      // Validate each entry has (origin or domain) and username strings
       for (const inst of replicatedInstances) {
-        if (!inst || typeof inst.domain !== 'string' || typeof inst.username !== 'string') {
-          return reply.code(400).send({ error: 'Each replicated instance must have domain and username strings', statusCode: 400 });
+        if (!inst || typeof inst.username !== 'string') {
+          return reply.code(400).send({ error: 'Each replicated instance must have username string', statusCode: 400 });
+        }
+        if (typeof inst.origin !== 'string' && typeof inst.domain !== 'string') {
+          return reply.code(400).send({ error: 'Each replicated instance must have origin or domain string', statusCode: 400 });
         }
       }
       if (replicatedInstances.length > 50) {