<!-- Thanks for contributing. Keep one logical change per pull request. -->

## What this changes

<!-- A short summary of the change and the problem it solves. Link the issue it addresses. -->

Closes #

## Type of change

- [ ] Bug fix
- [ ] New feature
- [ ] Refactor or cleanup
- [ ] Documentation
- [ ] Other

## Checklist

- [ ] `pnpm build` succeeds (shared types, server, and web all build)
- [ ] `pnpm dev` starts the server and web client without errors
- [ ] Tests pass where applicable (`pnpm test`)
- [ ] I updated the relevant `docs/systems/` spec if this changed schema, API routes, WebSocket events, the federation protocol, permissions, or the design system
- [ ] This change resolves the correct federated identity where it compares IDs, checks permissions, or talks to remote servers (no assumption of a single global user ID)
- [ ] I have read and agree to the [CLA](../CLA.md)

## Notes for reviewers

<!-- Anything that helps review: screenshots for UI, migration notes, edge cases, follow-ups. -->