fix(dm): owner-only group DM ops accept federated target identification

Transferring ownership or kicking a member surfaced "Target user is not a
member of this DM channel" whenever the target was a federated user.

Root cause: the client passed `canonical.id` from `useCanonicalUserView`,
which returns the user's HOME id when the home view is in the userViews
cache. After owner-routing the request to the owner instance, that
instance's `dm_members.userId` (its own local replicated id) never
matched the home id, so `isDmMember` returned false. The same failure
mode applied across any cross-instance scenario where the
channel-serving instance and the owner-serving instance disagree on the
local replicated user id for the same federated user.

Fix: both endpoints now accept federated identification, mirroring the
existing pattern on `POST /api/dm/:id/members`:

- `POST /api/dm/:id/transfer` body: `{ newOwnerId? } | { homeUserId, homeInstance }`.
  Federated args win when both are supplied (strictly more specific).
- `DELETE /api/dm/:id/members/:targetUserId` reads optional
  `?homeInstance=<origin>` query; when present, the URL segment is
  treated as a homeUserId and resolved via `resolveOrCreateReplicatedUser`.

Client `api.dm.kickMember` and `api.dm.transferOwnership` gain an
optional `federated` argument; `DmRosterPanel` and `MobileGroupDmInfo`
pass it whenever the target has `homeUserId` + `homeInstance` populated.

Adds 5 server tests (3 transfer + 2 kick) covering federated targets,
the federated-wins-over-local precedence rule, and federated-non-member
rejection. Updates 2 client routing tests and 2 DmRosterPanel test
assertions for the new signature. Updates `docs/systems/dm-system.md`
and `docs/systems/api.md`.

Server: 965 tests pass (was 960). Web: 362 tests pass (was 360).

packages/web/src/components/layout/DmRosterPanel.test.tsx

@@ -106,9 +106,16 @@ const apiTransferOwnership = vi.fn().mockResolvedValue({});
 vi.mock('../../api/client', () => ({
   api: {
     dm: {
-      kickMember: (channelId: string, userId: string) => apiKickMember(channelId, userId),
-      transferOwnership: (channelId: string, userId: string) =>
-        apiTransferOwnership(channelId, userId),
+      kickMember: (
+        channelId: string,
+        userId: string,
+        federated?: { homeUserId: string; homeInstance: string },
+      ) => apiKickMember(channelId, userId, federated),
+      transferOwnership: (
+        channelId: string,
+        userId: string,
+        federated?: { homeUserId: string; homeInstance: string },
+      ) => apiTransferOwnership(channelId, userId, federated),
     },
   },
 }));
@@ -343,7 +350,8 @@ describe('DmRosterPanel — action wiring', () => {
     await waitFor(() => {
       expect(apiKickMember).toHaveBeenCalledTimes(1);
     });
-    expect(apiKickMember).toHaveBeenCalledWith('dm-1', 'tgt');
+    // Local target → federated arg is undefined.
+    expect(apiKickMember).toHaveBeenCalledWith('dm-1', 'tgt', undefined);
   });
 
   it('transfer action: opens confirm dialog, then calls api.dm.transferOwnership on confirm', async () => {
@@ -367,7 +375,8 @@ describe('DmRosterPanel — action wiring', () => {
     await waitFor(() => {
       expect(apiTransferOwnership).toHaveBeenCalledTimes(1);
     });
-    expect(apiTransferOwnership).toHaveBeenCalledWith('dm-1', 'tgt');
+    // Local target → federated arg is undefined.
+    expect(apiTransferOwnership).toHaveBeenCalledWith('dm-1', 'tgt', undefined);
   });
 
   it('remove-friend action: calls socialStore.removeFriend with the row user id', async () => {

packages/web/src/components/layout/DmRosterPanel.tsx

@@ -121,7 +121,17 @@ export function DmRosterPanel() {
     if (!pendingKick) return;
     setSubmitting(true);
     try {
-      await api.dm.kickMember(dmChannel.id, pendingKick.id);
+      // Pass federated identity when the target is a federated user.
+      // `pendingKick.id` may be the home id (when the home view is in the
+      // userViews cache) OR a local id from any instance — neither is
+      // guaranteed to match the OWNER instance's local replicated id. The
+      // owner instance resolves home id + home instance via
+      // `resolveOrCreateReplicatedUser`, which is the only deterministic
+      // way to find the right `dm_members.userId` row across instances.
+      const federated = pendingKick.homeUserId && pendingKick.homeInstance
+        ? { homeUserId: pendingKick.homeUserId, homeInstance: pendingKick.homeInstance }
+        : undefined;
+      await api.dm.kickMember(dmChannel.id, pendingKick.id, federated);
       addToast(
         `Removed ${pendingKick.displayName ?? parseFederatedUsername(pendingKick.username).baseName} from the group`,
         'success',
@@ -143,7 +153,11 @@ export function DmRosterPanel() {
     if (!pendingTransfer) return;
     setSubmitting(true);
     try {
-      await api.dm.transferOwnership(dmChannel.id, pendingTransfer.id);
+      // See confirmKick for the rationale on federated identity.
+      const federated = pendingTransfer.homeUserId && pendingTransfer.homeInstance
+        ? { homeUserId: pendingTransfer.homeUserId, homeInstance: pendingTransfer.homeInstance }
+        : undefined;
+      await api.dm.transferOwnership(dmChannel.id, pendingTransfer.id, federated);
       addToast(
         `Ownership transferred to ${pendingTransfer.displayName ?? parseFederatedUsername(pendingTransfer.username).baseName}`,
         'success',

packages/web/src/components/layout/MobileGroupDmInfo.tsx

@@ -332,7 +332,11 @@ export function MobileGroupDmInfo({ params }: MobileGroupDmInfoProps) {
     if (!pendingKick || !channelId) return;
     setSubmittingMemberAction(true);
     try {
-      await api.dm.kickMember(channelId, pendingKick.id);
+      // See DmRosterPanel.confirmKick for federated identity rationale.
+      const federated = pendingKick.homeUserId && pendingKick.homeInstance
+        ? { homeUserId: pendingKick.homeUserId, homeInstance: pendingKick.homeInstance }
+        : undefined;
+      await api.dm.kickMember(channelId, pendingKick.id, federated);
       addToast(
         `Removed ${pendingKick.displayName ?? parseFederatedUsername(pendingKick.username).baseName} from the group`,
         'success',
@@ -354,7 +358,11 @@ export function MobileGroupDmInfo({ params }: MobileGroupDmInfoProps) {
     if (!pendingTransfer || !channelId) return;
     setSubmittingMemberAction(true);
     try {
-      await api.dm.transferOwnership(channelId, pendingTransfer.id);
+      // See DmRosterPanel.confirmKick for federated identity rationale.
+      const federated = pendingTransfer.homeUserId && pendingTransfer.homeInstance
+        ? { homeUserId: pendingTransfer.homeUserId, homeInstance: pendingTransfer.homeInstance }
+        : undefined;
+      await api.dm.transferOwnership(channelId, pendingTransfer.id, federated);
       addToast(
         `Ownership transferred to ${pendingTransfer.displayName ?? parseFederatedUsername(pendingTransfer.username).baseName}`,
         'success',