feat: lift DM gates for federated users

Remove requireLocalUser from DM routes, include DMs in federated
ready payload, replace blanket dm_* WS gate with call-only blocklist.
DM calls remain gated (separate scope).

packages/server/src/ws/handler.ts

@@ -1108,8 +1108,8 @@ function buildReadyPayload(userId: string): {
   // Store user's space IDs for broadcasting
   connectionManager.setUserSpaces(userId, spaceIds);
 
-  // Get DM channels — skip entirely for federated users (they get DMs from their home instance)
-  const dmMemberships = isFederated ? [] : db.select()
+  // Get DM channels
+  const dmMemberships = db.select()
     .from(schema.dmMembers)
     .where(and(
       eq(schema.dmMembers.userId, userId),
@@ -1198,6 +1198,7 @@ function buildReadyPayload(userId: string): {
 
       dmChannels.push({
         id: dmChannel.id,
+        federatedId: dmChannel.federatedId ?? null,
         ownerId: dmChannel.ownerId ?? null,
         createdAt: dmChannel.createdAt,
         members,
@@ -1214,6 +1215,11 @@ function buildReadyPayload(userId: string): {
 
   }
 
+  // Include DM channel IDs in the visible set for read state filtering
+  for (const dm of dmChannels) {
+    visibleChannelIdSet.add(dm.id);
+  }
+
   // Get Space Folders
   const folderRows = db.select()
     .from(schema.spaceFolders)