perf: Optimize MongoDB queries in findMentionedMessages and findStarredMessages with Promise.all

Description:

In apps/meteor/app/api/server/lib/messages.ts, the following service functions perform two independent MongoDB lookups (Rooms.findOneById and Users.findOneById) sequentially using await, even though neither result depends on the other:

• findMentionedMessages (lines 21-28)
• findStarredMessages (lines 60-67)

These functions power the Activity Hub's Mentions and Starred Messages tabs.

Current Code (same pattern in both functions):

// Sequential — second DB call waits for first unnecessarily
const room = await Rooms.findOneById(roomId);
if (!room || !(await canAccessRoomAsync(room, { _id: uid }))) {
    throw new Error('error-not-allowed');
}
const user = await Users.findOneById(uid, { projection: { username: 1 } });
if (!user) {
    throw new Error('invalid-user');
}

Since room and user are fetched from independent collections and neither depends on the other's result, they block each other for no reason, adding unnecessary latency to every mention/starred messages API call.

Steps to reproduce:

1. Open any room's Mentions panel or Starred Messages panel
2. Observe server logs - Rooms.findOneById and Users.findOneById run one after the other
3. Total API response time = Room lookup time + User lookup time

Expected behavior:

Both Rooms.findOneById and Users.findOneById are independent queries — they should run concurrently using Promise.all, reducing total wait time to the duration of the slower query.

Actual behavior:

The second DB lookup is blocked until the first completes, adding ~50ms unnecessary latency per request (assuming 50ms average DB query time).

Additional context

No behavior change — purely a performance improvement
Affects Activity Hub core features (Mentions and Starred Messages tabs)
Consistent with Promise.all optimization pattern applied in #39580 for thread endpoints
I have a fix ready and can open a PR immediately

Relevant logs:

No logs required — issue is visible directly in source code structure.

Start in apps/meteor/app/api/server/lib/messages.ts and inspect findMentionedMessages and findStarredMessages, comparing their independent room and user lookups with the Promise.all pattern referenced in #39580. Verify the Mentions and Starred Messages entry points still enforce the existing access and user checks while completing both lookups without unnecessary sequential waiting.