fix: broadcast channel_created with per-user permission filtering

Compute permissions per-user before broadcasting so users without
VIEW_CHANNEL never receive the channel_created event.

packages/server/src/routes/channels.ts

@@ -148,12 +148,20 @@ export async function channelRoutes(app: FastifyInstance): Promise<void> {
 
     const channelData = rowToChannel(channel);
 
-    // Broadcast channel_created to all space members
+    // Broadcast channel_created with per-user permissions
-    connectionManager.sendToSpace(id, {
+    // (same pattern as broadcastOverrideChange — permissions are per-user
-      type: 'channel_created',
+    // so we must compute individually rather than broadcast uniformly)
-      channel: channelData,
+    for (const [userId, spaceIds] of connectionManager.getUserSpaceEntries()) {
-      spaceId: id,
+      if (!spaceIds.has(id)) continue;
-    });
+      const perms = computePermissions(userId, id, channelId);
+      if ((perms & PermissionBits.VIEW_CHANNEL) !== 0n) {
+        connectionManager.sendToUser(userId, {
+          type: 'channel_created',
+          channel: { ...channelData, myPermissions: permissionsToString(perms) },
+          spaceId: id,
+        });
+      }
+    }
 
     return reply.code(201).send(channelData);
   });