fix: persistent random Snowflake worker ID + clean reaction API

Two fixes addressing architectural review feedback:

1. Snowflake ID collisions: Replace process.pid-based worker ID with a
   cryptographically random value (0-1023) generated once at first boot
   and persisted to instance_settings.worker_id. Eliminates deterministic
   ID collisions between Docker instances that all run as PID 1.

2. Reaction API leak: Revert addReaction/removeReaction signatures to
   (messageId, emoji) — the store now resolves the channel internally by
   scanning its message cache, keeping routing logic out of the UI layer.

packages/server/src/utils/snowflake.ts

@@ -10,15 +10,35 @@
  * - ~139 years of IDs from epoch
  * - 1024 workers
  * - 4096 IDs per millisecond per worker
+ *
+ * IMPORTANT: The worker ID MUST be unique per instance to prevent ID
+ * collisions in a federation setup. It is generated randomly at first boot
+ * and persisted to the database. Call setWorkerId() before generating any IDs.
  */
 
 const EPOCH = 1704067200000n; // Jan 1, 2024 00:00:00 UTC
-const WORKER_ID = BigInt(process.pid % 1024);
 
+let WORKER_ID: bigint | null = null;
 let sequence = 0n;
 let lastTimestamp = -1n;
 
+/**
+ * Set the worker ID for this instance. Must be called once during server
+ * startup, after the database is initialized, before any IDs are generated.
+ * The value is persisted in instance_settings.worker_id.
+ */
+export function setWorkerId(id: number): void {
+  if (id < 0 || id > 1023) {
+    throw new Error(`Worker ID must be 0-1023, got ${id}`);
+  }
+  WORKER_ID = BigInt(id);
+}
+
 export function generateSnowflake(): string {
+  if (WORKER_ID === null) {
+    throw new Error('Snowflake worker ID not initialized — call setWorkerId() during startup');
+  }
+
   let timestamp = BigInt(Date.now());
 
   if (timestamp === lastTimestamp) {