Phase 7: Bot/extension system

Bot accounts (User rows with is_bot=True), scoped API tokens (read:messages,
write:messages, manage:rooms) authenticated via Authorization: Bearer on both
REST and the WS handshake, live bot WebSocket access on the same /ws/chat
endpoint humans use, message editing (WS "edit" envelope -> message_update
broadcast, fans out cross-instance for free via the existing broadcaster),
incoming webhooks (room-scoped, no auth beyond the URL token), and outgoing
webhooks/event subscriptions (HMAC-SHA256 signed, backgrounded delivery,
creation-time SSRF validation against private/loopback/link-local targets).

Token auth is additive, not a parallel system: a bearer-token-authenticated
bot goes through the exact same room-membership/role checks a session-
authenticated human does everywhere; only read:messages/write:messages are
separately scope-gated (the two message endpoints). manage:rooms scope
enforcement, full per-delivery SSRF re-validation, and bot API rate limiting
were explicitly scoped out (confirmed with the repo owner) as disproportionate
to this phase -- documented as known gaps in backend/README.md rather than
silently skipped.

Admin portal gains a Bots tab (create bots, issue/revoke scoped tokens,
cross-room webhook visibility); RoomInfoPanel gains room-scoped webhook/
subscription management, mirroring how invites already work there. The chat
UI also gets a minimal "edit your own message" affordance -- not asked for
by the issue, but the only practical way to exercise the edit pipeline by
hand instead of only via a scripted bot client.

Along the way: fixed a real bug caught while writing the incoming-webhook
test -- offline-push notification relied on the sender being "connected" to
exclude themselves, true for WS-originated messages but not for the new
webhook path, which has no WS connection for the attributed sender at all.
Now explicitly excluded. Also discovered the REST-only test fixture never
triggered ASGI lifespan, so app.state.broadcaster/presence didn't exist for
it; moved their construction out of the lifespan into create_app() itself
(Redis client construction is synchronous/lazy) so both the WS and
REST-only paths always have them.

New tests/test_bots.py, test_message_edit.py, test_webhooks.py (full suite
now 78/78, stable across repeated runs) plus a scripted end-to-end smoke
test (bot WS join/post/edit, incoming webhook, SSRF rejection, outgoing
delivery) and a full browser walkthrough of the new admin/room UI.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/components/MessageList.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useRef } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { useAuth } from '../context/AuthContext'
 import { senderColorIndex } from '../lib/messageGrouping'
 import type { ChatMessageEnvelope, Message, RoomMember } from '../types'
@@ -8,16 +8,30 @@ import './MessageList.css'
 interface MessageListProps {
   messages: (Message | ChatMessageEnvelope)[]
   members: RoomMember[]
+  onEdit: (messageId: string, content: string) => void
 }
 
-export function MessageList({ messages, members }: MessageListProps) {
+export function MessageList({ messages, members, onEdit }: MessageListProps) {
   const { user } = useAuth()
   const bottomRef = useRef<HTMLDivElement>(null)
+  const [editingId, setEditingId] = useState<string | null>(null)
+  const [draft, setDraft] = useState('')
 
   useEffect(() => {
     bottomRef.current?.scrollIntoView({ block: 'end' })
   }, [messages.length])
 
+  function startEdit(msg: Message | ChatMessageEnvelope) {
+    setEditingId(msg.id)
+    setDraft(msg.content)
+  }
+
+  function commitEdit(messageId: string) {
+    const trimmed = draft.trim()
+    if (trimmed) onEdit(messageId, trimmed)
+    setEditingId(null)
+  }
+
   return (
     <div className="message-list">
       {messages.map((msg, i) => {
@@ -25,6 +39,7 @@ export function MessageList({ messages, members }: MessageListProps) {
         const prev = messages[i - 1]
         const showAvatar = !mine && (!prev || prev.user_id !== msg.user_id)
         const showName = showAvatar
+        const editing = editingId === msg.id
 
         return (
           <div key={msg.id} className={`message-row${mine ? ' message-row-mine' : ''}`}>
@@ -37,9 +52,36 @@ export function MessageList({ messages, members }: MessageListProps) {
             )}
             <div className="message-bubble-wrap">
               {showName && <div className="message-author">{msg.username}</div>}
-              <div className={`message-bubble${mine ? ' message-bubble-mine' : ''}`}>{msg.content}</div>
+              {editing ? (
+                <input
+                  autoFocus
+                  className="message-edit-input"
+                  value={draft}
+                  onChange={(e) => setDraft(e.target.value)}
+                  onKeyDown={(e) => {
+                    if (e.key === 'Enter') commitEdit(msg.id)
+                    if (e.key === 'Escape') setEditingId(null)
+                  }}
+                  onBlur={() => commitEdit(msg.id)}
+                />
+              ) : (
+                <div className={`message-bubble${mine ? ' message-bubble-mine' : ''}`}>
+                  {msg.content}
+                  {mine && (
+                    <button
+                      type="button"
+                      className="message-edit-link"
+                      onClick={() => startEdit(msg)}
+                      aria-label="Edit message"
+                    >
+                      Edit
+                    </button>
+                  )}
+                </div>
+              )}
               <div className="message-time">
                 {new Date(msg.created_at).toLocaleTimeString([], { hour: 'numeric', minute: '2-digit' })}
+                {msg.edited_at && <span className="message-edited"> (edited)</span>}
               </div>
             </div>
           </div>