fix(dm): owner-only group DM ops accept federated target identification

Transferring ownership or kicking a member surfaced "Target user is not a
member of this DM channel" whenever the target was a federated user.

Root cause: the client passed `canonical.id` from `useCanonicalUserView`,
which returns the user's HOME id when the home view is in the userViews
cache. After owner-routing the request to the owner instance, that
instance's `dm_members.userId` (its own local replicated id) never
matched the home id, so `isDmMember` returned false. The same failure
mode applied across any cross-instance scenario where the
channel-serving instance and the owner-serving instance disagree on the
local replicated user id for the same federated user.

Fix: both endpoints now accept federated identification, mirroring the
existing pattern on `POST /api/dm/:id/members`:

- `POST /api/dm/:id/transfer` body: `{ newOwnerId? } | { homeUserId, homeInstance }`.
  Federated args win when both are supplied (strictly more specific).
- `DELETE /api/dm/:id/members/:targetUserId` reads optional
  `?homeInstance=<origin>` query; when present, the URL segment is
  treated as a homeUserId and resolved via `resolveOrCreateReplicatedUser`.

Client `api.dm.kickMember` and `api.dm.transferOwnership` gain an
optional `federated` argument; `DmRosterPanel` and `MobileGroupDmInfo`
pass it whenever the target has `homeUserId` + `homeInstance` populated.

Adds 5 server tests (3 transfer + 2 kick) covering federated targets,
the federated-wins-over-local precedence rule, and federated-non-member
rejection. Updates 2 client routing tests and 2 DmRosterPanel test
assertions for the new signature. Updates `docs/systems/dm-system.md`
and `docs/systems/api.md`.

Server: 965 tests pass (was 960). Web: 362 tests pass (was 360).

packages/web/src/utils/groupDm.ownerRouting.test.ts

@@ -160,7 +160,25 @@ describe('group DM owner routing — api.dm.* (Task 5.2)', () => {
     await api.dm.kickMember('dm-1', 'target-user');
 
     expect(mockGetApiForOrigin).toHaveBeenCalledWith('https://orbit.test');
-    expect(remoteClient.dm.kickMember).toHaveBeenCalledWith('dm-1', 'target-user');
+    // Third arg is the optional federated identity (undefined when target is local)
+    expect(remoteClient.dm.kickMember).toHaveBeenCalledWith('dm-1', 'target-user', undefined);
+  });
+
+  it('after transfer: api.dm.kickMember forwards federated identity when supplied', async () => {
+    useSpaceStore.setState({
+      dmChannels: [{ ...baseDm, ownerHomeInstance: 'https://orbit.test' }],
+    });
+
+    await api.dm.kickMember('dm-1', 'target-user', {
+      homeUserId: 'target-home-id',
+      homeInstance: 'https://orbit.test',
+    });
+
+    expect(mockGetApiForOrigin).toHaveBeenCalledWith('https://orbit.test');
+    expect(remoteClient.dm.kickMember).toHaveBeenCalledWith('dm-1', 'target-user', {
+      homeUserId: 'target-home-id',
+      homeInstance: 'https://orbit.test',
+    });
   });
 
   it('after transfer: api.dm.transferOwnership routes to new owner instance', async () => {
@@ -171,7 +189,24 @@ describe('group DM owner routing — api.dm.* (Task 5.2)', () => {
     await api.dm.transferOwnership('dm-1', 'next-owner');
 
     expect(mockGetApiForOrigin).toHaveBeenCalledWith('https://orbit.test');
-    expect(remoteClient.dm.transferOwnership).toHaveBeenCalledWith('dm-1', 'next-owner');
+    expect(remoteClient.dm.transferOwnership).toHaveBeenCalledWith('dm-1', 'next-owner', undefined);
+  });
+
+  it('after transfer: api.dm.transferOwnership forwards federated identity when supplied', async () => {
+    useSpaceStore.setState({
+      dmChannels: [{ ...baseDm, ownerHomeInstance: 'https://orbit.test' }],
+    });
+
+    await api.dm.transferOwnership('dm-1', 'next-owner', {
+      homeUserId: 'next-owner-home-id',
+      homeInstance: 'https://orbit.test',
+    });
+
+    expect(mockGetApiForOrigin).toHaveBeenCalledWith('https://orbit.test');
+    expect(remoteClient.dm.transferOwnership).toHaveBeenCalledWith('dm-1', 'next-owner', {
+      homeUserId: 'next-owner-home-id',
+      homeInstance: 'https://orbit.test',
+    });
   });
 
   it('non-owner-only op (sendMessage) is unaffected by ownerHomeInstance', async () => {