feat(chat): @everyone mention

Rides the existing `<@id>` token: `everyone` already matches the parser's
`[a-zA-Z0-9_-]+`, so the markdown pre-processor, the inline renderer and the
badge pick it up with no second syntax. User ids are snowflakes, so the
literal `everyone` cannot collide with one.

Gated on a new MENTION_EVERYONE permission rather than being open to all —
otherwise a role can never take it away. Granted to @everyone by default: on
a small instance the ping is a convenience, not a weapon, and an owner who
disagrees can deny it and grant it to a role instead.

Two things that would each have made the gate a no-op:

  - DEFAULT_EVERYONE_PERMISSIONS only applies at space creation, so spaces
    that predate the bit would have had every @everyone mention silently
    stripped. A boot-time backfill ORs the bit into @everyone roles only
    (`id = space_id`), leaving other roles alone so a later denial is not
    overruled on the next restart. Verified against a copy of the production
    database: three roles moved by exactly 2^15, non-@everyone roles
    untouched, second pass a no-op.
  - Enforcement covers edit as well as create; without that, posting a plain
    message and editing it is the way around the permission.

A message that lacks the permission is not rejected — losing what someone
wrote over one token is worse than posting it. The token is demoted to the
literal `@everyone` text they typed: the message reads the same and rings
nobody.

Code spans and fences never ping. People paste payloads and snippets into
chat, and a paste should not ring everyone's client. The same rule decides
the row highlight and the notification sound, so the three cannot disagree.

Verified: web build, server typecheck, 504 web tests, 804 server tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/server/src/db/migrate.ts

@@ -87,3 +87,44 @@ export function backfillOneOnOneDmMembership(db: Database.Database): void {
   run();
   if (restored > 0) console.log(`[backfill] restored ${restored} deleted-partner DM membership row(s)`);
 }
+
+/**
+ * Grant MENTION_EVERYONE on @everyone roles that predate the bit.
+ *
+ * `DEFAULT_EVERYONE_PERMISSIONS` only applies at space creation, so spaces
+ * created before the bit existed carry a stored value without it — and would
+ * silently have @everyone mentions stripped for every member. This ORs the bit
+ * in once.
+ *
+ * Idempotent by construction: the OR is a no-op when the bit is already set,
+ * and the WHERE clause skips those rows anyway. Deliberately scoped to the
+ * @everyone role (`id = space_id`), so an owner who later denies the
+ * permission is not overruled on the next boot — their denial lives on a
+ * different row.
+ */
+export function grantMentionEveryoneToLegacyRoles(db: Database.Database): void {
+  const BIT = 1n << 15n;
+
+  const rows = db.prepare(
+    `SELECT id, permissions FROM roles WHERE id = space_id`
+  ).all() as { id: string; permissions: string | null }[];
+
+  const update = db.prepare('UPDATE roles SET permissions = ? WHERE id = ?');
+  let changed = 0;
+
+  for (const row of rows) {
+    let current: bigint;
+    try {
+      current = BigInt(row.permissions ?? '0');
+    } catch {
+      continue;  // unparseable value — leave it for a human, do not guess
+    }
+    if ((current & BIT) !== 0n) continue;
+    update.run((current | BIT).toString(), row.id);
+    changed++;
+  }
+
+  if (changed > 0) {
+    console.log(`[defaults] Granted MENTION_EVERYONE to ${changed} @everyone role(s)`);
+  }
+}