feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

packages/web/src/hooks/useWebSocket.ts

@@ -238,8 +238,8 @@ function handleEvent(origin: string, event: ServerEvent): void {
         }
       }
 
-      // Restore DM call state from server (home only)
-      if (isHome) {
+      // Restore DM call state from server (all origins — federated DMs live on remote instances)
+      {
         const { activeDmCall, setActiveDmCall, setIncomingCall, incomingCall } = useVoiceStore.getState();
         const myId = event.user.id;
         if (event.activeCalls && event.activeCalls.length > 0) {
@@ -521,10 +521,9 @@ function handleEvent(origin: string, event: ServerEvent): void {
       break;
     }
 
-    // ─── DM call events (home-only) ─────────────────────────────────────────
+    // ─── DM call events (all origins) ──────────────────────────────────────
 
     case 'dm_call_incoming': {
-      if (!isHome) break;
       const { setIncomingCall } = useVoiceStore.getState();
       setIncomingCall({
         dmChannelId: event.dmChannelId,
@@ -535,7 +534,6 @@ function handleEvent(origin: string, event: ServerEvent): void {
     }
 
     case 'dm_call_accepted': {
-      if (!isHome) break;
       const { setIncomingCall, setOutgoingCall, setActiveDmCall } = useVoiceStore.getState();
       setIncomingCall(null);
       setOutgoingCall(null);
@@ -544,7 +542,6 @@ function handleEvent(origin: string, event: ServerEvent): void {
     }
 
     case 'dm_call_rejected': {
-      if (!isHome) break;
       const { setIncomingCall, setOutgoingCall, setActiveDmCall } = useVoiceStore.getState();
       setIncomingCall(null);
       setOutgoingCall(null);
@@ -553,7 +550,6 @@ function handleEvent(origin: string, event: ServerEvent): void {
     }
 
     case 'dm_call_ended': {
-      if (!isHome) break;
       const { setIncomingCall, setOutgoingCall, setActiveDmCall } = useVoiceStore.getState();
       setIncomingCall(null);
       setOutgoingCall(null);