feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

packages/web/src/stores/voiceStore.ts

@@ -527,7 +527,7 @@ export const useVoiceStore = create<VoiceState>()(
     }),
     {
       name: 'backspace-voice-settings',
-      version: 8,
+      version: 9,
       migrate: (persistedState: any, version: number) => {
         if (version === 0) {
           persistedState.streamAttenuationEnabled = false;
@@ -563,6 +563,9 @@ export const useVoiceStore = create<VoiceState>()(
         if (version < 8) {
           persistedState.soundEffectVolume = 100;
         }
+        if (version < 9) {
+          delete persistedState.currentVoiceChannelId;
+        }
         return persistedState;
       },
       storage: createJSONStorage(() => localStorage),
@@ -570,7 +573,6 @@ export const useVoiceStore = create<VoiceState>()(
       // noiseSuppression is intentionally excluded — always true internally,
       // managed automatically by AudioManager based on RNNoise state.
       partialize: (state) => ({
-        currentVoiceChannelId: state.currentVoiceChannelId,
         isMuted: state.isMuted,
         isDeafened: state.isDeafened,
         inputVolume: state.inputVolume,