Permission enforcement and forbidden-state UX sweep

## Summary
Sweep the product for permission enforcement gaps and inconsistent forbidden-state UX.

## Scope
- Audit all major user actions for correct server-side permission enforcement.
- Align UI affordances so hidden, disabled, and forbidden states behave consistently.
- Handle forbidden navigation and stale permission changes gracefully.
- Cover message, reaction, thread, attachment, moderation, settings, and management surfaces.

## Acceptance Criteria
- [ ] No privileged action succeeds based only on client-side gating.
- [ ] Users get consistent, comprehensible feedback when they lose access or attempt a forbidden action.
- [ ] Stale tabs and reconnects recover into a safe visible state instead of crashing or silently misbehaving.
- [ ] Automated tests cover the highest-risk permission boundaries.

## Operational Notes
- Permission correctness is a product and safety requirement, not only a backend concern.
- This issue should prefer exact behavior parity unless a self-hosting deviation is intentional and documented.