POST /api/dm created channels with federatedId=NULL, so when the S2S reply arrived, processCreateEvent couldn't find the channel and created a duplicate. Now computes the deterministic SHA256 hash at creation time when either participant is federated.