fix: prevent duplicate DMs at creation time, clean up corrupted read states

Replace the unreliable client-side DM dedup loop in populateFromReady with
a creation-time guard (findExistingDmForUser) that checks all instances
before opening a new DM. Guards added to FriendsPage, NewDmModal, and
UserProfilePopout.

Also fixes: corrupted read_states from temp_ optimistic message IDs (server
migration + client-side validation), federation-aware closeDm/addDmMember
API routing, isSelf-based DM member filtering in sidebar/header, and WS
event error isolation.

packages/web/src/hooks/useWebSocket.ts

@@ -547,11 +547,17 @@ function connectToOrigin(origin: string, token: string): void {
   };
 
   ws.onmessage = (e) => {
+    let event: ServerEvent;
     try {
-      const event = JSON.parse(e.data as string) as ServerEvent;
-      handleEvent(origin, event);
+      event = JSON.parse(e.data as string) as ServerEvent;
     } catch {
       console.error(`Failed to parse WebSocket message (${origin || 'home'})`);
+      return;
+    }
+    try {
+      handleEvent(origin, event);
+    } catch (err) {
+      console.error(`Error handling WS event "${event.type}" (${origin || 'home'}):`, err);
     }
   };
 
@@ -617,6 +623,12 @@ export function disconnectAllRemote(): void {
   }
 }
 
+/** Read-only home WS connection status — safe to call from any component without managing lifecycle. */
+export function getHomeWsConnected(): boolean {
+  const conn = connections.get(HOME_ORIGIN);
+  return !!conn?.ws && conn.ws.readyState === WebSocket.OPEN;
+}
+
 /** Send an event over the WebSocket. Can be used outside of React components. */
 export function wsSend(event: ClientEvent, origin: string = HOME_ORIGIN): void {
   const conn = connections.get(origin);