feat: add voice disconnect permission and fix federation identity

- Add DISCONNECT_MEMBERS permission (bit 27) to disconnect users from voice
- Implement voice_disconnect WebSocket handler with permission checks
- Add disconnect button to voice user context menu
- Grant instance admins full permissions across all spaces
- Fix voice_disconnected handler to use federation-aware identity resolution
- Update CLAUDE.md with new event types and permission docs

packages/shared/src/permissions.ts

@@ -23,6 +23,7 @@ export const PermissionBits = {
   MOVE_MEMBERS:         1n << 24n,
   USE_VOICE_ACTIVITY:   1n << 25n,
   STREAM:               1n << 26n,
+  DISCONNECT_MEMBERS:   1n << 27n,
 } as const;
 
 export type PermissionBit = (typeof PermissionBits)[keyof typeof PermissionBits];

packages/shared/src/types.ts

@@ -240,6 +240,7 @@ export type ClientEvent =
   | { type: 'voice_server_mute'; userId: string; muted: boolean }
   | { type: 'voice_server_deafen'; userId: string; deafened: boolean }
   | { type: 'voice_move'; userId: string; targetChannelId: string }
+  | { type: 'voice_disconnect'; userId: string }
   | { type: 'ping' };
 
 // Server → Client Events
@@ -282,6 +283,7 @@ export type ServerEvent =
   | { type: 'voice_server_muted'; userId: string; channelId: string; spaceId: string; muted: boolean }
   | { type: 'voice_server_deafened'; userId: string; channelId: string; spaceId: string; deafened: boolean }
   | { type: 'voice_moved'; userId: string; oldChannelId: string; newChannelId: string }
+  | { type: 'voice_disconnected'; userId: string; channelId: string }
   | { type: 'member_banned'; spaceId: string; reason: string | null }
   | { type: 'pong' }
   | { type: 'error'; message: string };