feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

packages/web/src/stores/chatStore.ts

@@ -595,14 +595,16 @@ export const useChatStore = create<ChatState>((set, get) => ({
     });
   },
 
-  updateUserInMessages: (user: { id: string; [key: string]: any }) => {
+  updateUserInMessages: (user: { id: string; homeUserId?: string | null; [key: string]: any }) => {
     set((state) => {
       const newMessages = new Map(state.messages);
       let changed = false;
       for (const [channelId, msgs] of newMessages) {
         let channelChanged = false;
         const updated = msgs.map(m => {
-          if (m.userId === user.id) {
+          const matches = m.userId === user.id ||
+            (user.homeUserId && m.user?.homeUserId && m.user.homeUserId === user.homeUserId);
+          if (matches) {
             channelChanged = true;
             return { ...m, user: { ...m.user, ...user } };
           }

packages/web/src/stores/socialStore.ts

@@ -242,8 +242,9 @@ export const useSocialStore = create<SocialState>((set, get) => ({
         if (result.status !== 'fulfilled') return;
         const origin = searches[i]!.origin;
         for (const user of result.value) {
-          if (seen.has(user.id)) continue;
-          seen.add(user.id);
+          const dedupeKey = `${origin ?? ''}:${user.id}`;
+          if (seen.has(dedupeKey)) continue;
+          seen.add(dedupeKey);
           if (origin) normalizeUserAssets(user, origin);
           allUsers.push(user);
         }

packages/web/src/stores/voiceStore.ts

@@ -527,7 +527,7 @@ export const useVoiceStore = create<VoiceState>()(
     }),
     {
       name: 'backspace-voice-settings',
-      version: 8,
+      version: 9,
       migrate: (persistedState: any, version: number) => {
         if (version === 0) {
           persistedState.streamAttenuationEnabled = false;
@@ -563,6 +563,9 @@ export const useVoiceStore = create<VoiceState>()(
         if (version < 8) {
           persistedState.soundEffectVolume = 100;
         }
+        if (version < 9) {
+          delete persistedState.currentVoiceChannelId;
+        }
         return persistedState;
       },
       storage: createJSONStorage(() => localStorage),
@@ -570,7 +573,6 @@ export const useVoiceStore = create<VoiceState>()(
       // noiseSuppression is intentionally excluded — always true internally,
       // managed automatically by AudioManager based on RNNoise state.
       partialize: (state) => ({
-        currentVoiceChannelId: state.currentVoiceChannelId,
         isMuted: state.isMuted,
         isDeafened: state.isDeafened,
         inputVolume: state.inputVolume,