feat: add voice disconnect permission and fix federation identity

- Add DISCONNECT_MEMBERS permission (bit 27) to disconnect users from voice
- Implement voice_disconnect WebSocket handler with permission checks
- Add disconnect button to voice user context menu
- Grant instance admins full permissions across all spaces
- Fix voice_disconnected handler to use federation-aware identity resolution
- Update CLAUDE.md with new event types and permission docs

packages/shared/src/permissions.ts

@@ -23,6 +23,7 @@ export const PermissionBits = {
   MOVE_MEMBERS:         1n << 24n,
   USE_VOICE_ACTIVITY:   1n << 25n,
   STREAM:               1n << 26n,
+  DISCONNECT_MEMBERS:   1n << 27n,
 } as const;
 
 export type PermissionBit = (typeof PermissionBits)[keyof typeof PermissionBits];