Add a friends hub with realtime online presence

## Goal

Give authenticated users one dependable place to see friendships, pending requests, and which friends are currently available to race.

## User experience

Add a `/friends` route reachable from the header/profile menu with:

- online friends first, then offline friends;
- incoming and outgoing pending requests;
- actions to open a profile, accept/decline/cancel a request, unfriend, block, or invite an eligible friend to the current room;
- clear empty, loading, disconnected, and error states;
- a responsive layout that works with the existing mobile navigation.

## Presence contract

- Presence is ephemeral and friends-only in this surface.
- "Online" means the user has at least one authenticated Let’s Cube socket connected.
- Multiple tabs/devices count as one user; offline is emitted only after the last socket disconnects.
- Do not persist or display `last seen` in the MVP.
- Do not create durable "friend came online" notifications in the MVP.
- REST owns the durable friend list; Socket.IO only delivers presence changes. Reconnect must refetch/reconcile durable state.

## Acceptance criteria

- [ ] Add friend-list/request state and selectors without coupling React components directly to sockets.
- [ ] Move friend presence through the global namespace and existing per-user Socket.IO rooms.
- [ ] Compute first-connect/last-disconnect correctly across multiple processes through the Redis adapter.
- [ ] Deliver an initial presence snapshot and incremental updates only for accepted friendships.
- [ ] Handle Redis/socket interruption without deleting friendships or permanently showing stale presence.
- [ ] Add focused server tests for multi-tab, multi-process, blocked/unfriended, and reconnect behavior.
- [ ] Add client tests for sorting, request states, offline/error states, responsive actions, and reconnect reconciliation.
- [ ] Add a Cypress happy path with two authenticated test users.

## Dependencies

- #75 friendship lifecycle
- #105 notification/request state
- #82 public profile links

## Non-goals

- Persistent last-seen timestamps.
- Browser/OS push notifications.
- Direct messaging.