fix(federation): fix reaction relay using wrong ID for message lookup

Reaction outbox events used reactionId (add) or a composite dedup key
(remove) as the event messageId. The receiver looked up dm_messages by
sourceMessageId = event.messageId, which never matched because it was
searching for a reactionId, not the actual message ID.

Fix: include the actual DM messageId in the reaction payload JSON.
The receiver now uses event.reaction.messageId for the lookup, with
fallback to event.messageId for backward compatibility.

packages/server/src/routes/federation.ts

@@ -1252,14 +1252,16 @@ function processReactionAddEvent(
     return;
   }
 
-  // Find the local message corresponding to the source message
+  // Find the local message — use the actual message ID from the reaction payload,
+  // not event.messageId which is the outbox dedup key (reactionId)
+  const sourceMessageId = event.reaction.messageId ?? event.messageId;
   const localMsg = db
     .select()
     .from(schema.dmMessages)
     .where(
       and(
         eq(schema.dmMessages.sourceInstance, sourceInstance),
-        eq(schema.dmMessages.sourceMessageId, event.messageId),
+        eq(schema.dmMessages.sourceMessageId, sourceMessageId),
       ),
     )
     .get();
@@ -1337,14 +1339,16 @@ function processReactionRemoveEvent(
     return;
   }
 
-  // Find the local message
+  // Find the local message — use the actual message ID from the reaction payload,
+  // not event.messageId which is the outbox dedup key (composite string)
+  const sourceMessageId = event.reaction.messageId ?? event.messageId;
   const localMsg = db
     .select()
     .from(schema.dmMessages)
     .where(
       and(
         eq(schema.dmMessages.sourceInstance, sourceInstance),
-        eq(schema.dmMessages.sourceMessageId, event.messageId),
+        eq(schema.dmMessages.sourceMessageId, sourceMessageId),
       ),
     )
     .get();

packages/server/src/ws/events.ts

@@ -1135,6 +1135,7 @@ function handleReactionAdd(event: Record<string, unknown>, userId: string): void
     }));
     queueOutboxEvent(reactionId, dmMsg.dmChannelId, 'reaction_add', JSON.stringify({
       reaction: {
+        messageId,
         userId,
         homeUserId: reactionUser?.homeUserId || userId,
         emoji,
@@ -1212,6 +1213,7 @@ function handleReactionRemove(event: Record<string, unknown>, userId: string): v
       'reaction_remove',
       JSON.stringify({
         reaction: {
+          messageId,
           userId,
           homeUserId: removingUser?.homeUserId || userId,
           emoji,