fix: prevent duplicate DMs at creation time, clean up corrupted read states

Replace the unreliable client-side DM dedup loop in populateFromReady with
a creation-time guard (findExistingDmForUser) that checks all instances
before opening a new DM. Guards added to FriendsPage, NewDmModal, and
UserProfilePopout.

Also fixes: corrupted read_states from temp_ optimistic message IDs (server
migration + client-side validation), federation-aware closeDm/addDmMember
API routing, isSelf-based DM member filtering in sidebar/header, and WS
event error isolation.

packages/server/src/ws/events.ts

@@ -824,6 +824,8 @@ function handleChannelAck(event: Record<string, unknown>, userId: string): void
   const channelId = event.channelId as string;
   const messageId = event.messageId as string;
   if (!channelId || !messageId) return;
+  // Validate messageId is a valid snowflake (numeric string) — reject temp/garbage IDs
+  if (!/^\d+$/.test(messageId)) return;
 
   const db = getDb();