feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

packages/web/src/stores/socialStore.ts

@@ -242,8 +242,9 @@ export const useSocialStore = create<SocialState>((set, get) => ({
         if (result.status !== 'fulfilled') return;
         const origin = searches[i]!.origin;
         for (const user of result.value) {
-          if (seen.has(user.id)) continue;
-          seen.add(user.id);
+          const dedupeKey = `${origin ?? ''}:${user.id}`;
+          if (seen.has(dedupeKey)) continue;
+          seen.add(dedupeKey);
           if (origin) normalizeUserAssets(user, origin);
           allUsers.push(user);
         }