feat: add voice disconnect permission and fix federation identity

- Add DISCONNECT_MEMBERS permission (bit 27) to disconnect users from voice
- Implement voice_disconnect WebSocket handler with permission checks
- Add disconnect button to voice user context menu
- Grant instance admins full permissions across all spaces
- Fix voice_disconnected handler to use federation-aware identity resolution
- Update CLAUDE.md with new event types and permission docs

packages/server/src/utils/permissions.ts

@@ -32,6 +32,10 @@ export function computePermissions(userId: string, spaceId: string, channelId?:
   if (!space) return 0n;
   if (space.ownerId === userId) return ALL_PERMISSIONS;
 
+  // 1b. Instance admin — full access across all spaces
+  const userRow = db.select().from(schema.users).where(eq(schema.users.id, userId)).get();
+  if (userRow?.isAdmin === 1) return ALL_PERMISSIONS;
+
   // 2. Base permissions from @everyone role (id === spaceId)
   const everyoneRole = db.select().from(schema.roles)
     .where(and(eq(schema.roles.id, spaceId), eq(schema.roles.spaceId, spaceId)))