Add an auto-provisioned system account for automated messages (#74)

The #72 welcome message was attributed to whichever admin added the
member, since there was no system/bot sender concept -- every Message
row requires a real user_id. Adds a lazily-created "system" bot
account (reusing the existing is_bot infrastructure) and switches the
welcome message to post as it instead. Excluded from the People
directory and @mention autocomplete for free: the directory already
filters is_bot users, and mention suggestions are sourced from room
membership, which the system account is never added to.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/routers/rooms.py

@@ -46,6 +46,7 @@ from app.services.message_service import (
     list_recent_messages,
     list_room_attachments,
 )
+from app.services.system_user_service import get_or_create_system_user
 from app.services.upload_settings_service import format_mb, get_upload_settings
 from app.services.room_service import (
     AlreadyMemberError,
@@ -662,16 +663,18 @@ async def add_member_endpoint(
     # welcome message below would otherwise trigger out of order.
     await broadcast_room_added(request.app.state.broadcaster, data.user_id, room)
 
-    # #72: attributed to the admin doing the adding, not a new system/bot
-    # sender concept -- they're already a real, in-scope user for this
-    # request, and every Message row requires a real user_id today.
+    # #74: posted as the auto-provisioned System account, not the admin who
+    # did the adding -- "Welcome, bob!" reads as coming from the room/app
+    # itself, not as something the admin personally typed.
+    system_user = await get_or_create_system_user(db)
     welcome_name = membership.user.display_name or membership.user.username
     welcome_message = await create_message(
-        db, room.id, current_user.id, f"Welcome to #{room.name}, {welcome_name}!"
+        db, room.id, system_user.id, f"Welcome to #{room.name}, {welcome_name}!"
     )
     # Same "sending implies having seen the room" reasoning as ws/chat.py's
-    # own live-message path -- without it, the admin's own client would show
-    # this room as unread from a message they effectively just sent.
+    # own live-message path -- the admin is the one who caused this message,
+    # and is presumably already looking at this room's member management, so
+    # without this their own client would show it as unread regardless.
     await mark_room_read(db, room.id, current_user.id)
     await broadcast_new_message(
         db,
@@ -682,7 +685,7 @@ async def add_member_endpoint(
         str(request.base_url),
         room.id,
         welcome_message,
-        current_user,
+        system_user,
     )
 
     online_ids = await request.app.state.global_presence.online_user_ids([membership.user_id])