Implement REST endpoints gated by the unused messages:*/artifacts:* PAT scopes

## Problem

`messages:*` and `artifacts:*` are already selectable scopes when creating a personal access token, but no route actually checks them yet. Live chat and artifacts currently only flow through the Durable Object's WebSocket, so the REST endpoints these scopes are meant to gate simply don't exist — meaning a PAT holder can select a scope today that grants access to nothing.

## Proposed solution

- Design and add read-only REST endpoints for a room's chat history and artifacts (whiteboard snapshots, shared files) outside the live WebSocket — something like `GET /v1/rooms/:roomId/messages` and `GET /v1/rooms/:roomId/artifacts`, backed by the existing durable `RoomEvent` timeline.
- Gate them with the existing `messages:*`/`artifacts:*` scopes the same way `rooms:read`/`rooms:write` already gate other room routes.
- Either implement both, or — if one genuinely isn't worth building yet — remove it from the selectable scope list rather than leaving a scope that grants access to nothing, and update `docs/api.md#scopes` either way.

## References

- [`docs/roadmap.md`](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/roadmap.md) — "messages:* / artifacts:* scopes are defined but unused"
- [`docs/api.md#scopes`](https://github.com/hoangsonww/Threadline-RealTime-Collab/blob/main/docs/api.md)