Add URL previews for chat messages (#43)

Slack/Discord-style link unfurling: the first http(s) URL in a message's
content gets a small preview card (title/description/image/site name)
fetched from the page's Open Graph tags.

Backend:
- Message.preview_url (extracted at create/edit time, cheap regex, no
  I/O) points at a link_previews cache row keyed by URL -- the same URL
  posted in different messages/rooms fetches once, and a failed fetch is
  cached too so a dead URL isn't retried on every reference.
- The actual fetch runs in a background asyncio.create_task from
  broadcast_new_message/broadcast_message_update, on its own DB session,
  so a slow third-party site never delays message delivery. A separate
  "link_preview" WS envelope carries the result once it resolves.
- SSRF protection reuses app/services/ssrf.py's validate_target_url
  (renamed from UnsafeWebhookUrlError to UnsafeUrlError now that it's
  shared with webhooks), but re-validates before every hop of a redirect
  chain rather than once up front -- redirects are followed manually so
  each intermediate URL is checked before it's ever connected to.
- Parsed with stdlib html.parser -- no new dependency.

Frontend: a LinkPreviewCard rendered under message content when present,
patched into state live via the new WS envelope and included in message
history for reloads.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/models/__init__.py

@@ -4,6 +4,7 @@ from app.models.base import Base
 from app.models.custom_theme import CustomTheme
 from app.models.event_subscription import EventSubscription
 from app.models.invite import InviteStatus
+from app.models.link_preview import LinkPreview
 from app.models.membership import RoomMembership, RoomRole
 from app.models.message import Message
 from app.models.message_file import MessageFile
@@ -41,4 +42,5 @@ __all__ = [
     "WebhookIncoming",
     "EventSubscription",
     "CustomTheme",
+    "LinkPreview",
 ]

backend/app/models/link_preview.py

@@ -0,0 +1,32 @@
+import uuid
+from datetime import datetime
+
+from sqlalchemy import Boolean, DateTime, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.models.base import Base
+
+
+class LinkPreview(Base):
+    """A cache keyed by URL, not by message -- multiple messages (in the
+    same room or different ones) linking the same URL share one fetch
+    instead of each triggering their own. link_preview_service is the only
+    writer; Message.preview_url (the first URL found in a message's
+    content, set at creation time) is the join key a caller looks this up
+    by."""
+
+    __tablename__ = "link_previews"
+
+    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    url: Mapped[str] = mapped_column(String(2048), unique=True, index=True, nullable=False)
+    title: Mapped[str | None] = mapped_column(String(500))
+    description: Mapped[str | None] = mapped_column(String(1000))
+    image_url: Mapped[str | None] = mapped_column(String(2048))
+    site_name: Mapped[str | None] = mapped_column(String(200))
+    # Cached separately from a "no row yet" state so a URL that genuinely
+    # doesn't unfurl (no title, fetch error, blocked by SSRF checks) isn't
+    # re-fetched on every message that references it within the TTL.
+    fetch_failed: Mapped[bool] = mapped_column(Boolean, default=False, nullable=False)
+    fetched_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.clock_timestamp(), nullable=False
+    )

backend/app/models/message.py

@@ -1,7 +1,7 @@
 import uuid
 from datetime import datetime
 
-from sqlalchemy import CheckConstraint, DateTime, ForeignKey, Text, func
+from sqlalchemy import CheckConstraint, DateTime, ForeignKey, String, Text, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from app.models.base import Base
@@ -25,6 +25,12 @@ class Message(Base):
     content: Mapped[str | None] = mapped_column(Text)
     image_id: Mapped[uuid.UUID | None] = mapped_column(ForeignKey("message_images.id"))
     file_id: Mapped[uuid.UUID | None] = mapped_column(ForeignKey("message_files.id"))
+    # First http(s) URL found in content at creation time (see
+    # link_preview_service.extract_first_url), if any -- a plain string, not
+    # a FK, since the actual preview data lives in link_previews cached by
+    # URL and is looked up separately (see message_service.list_recent_
+    # messages), not eager-loaded as an ORM relationship.
+    preview_url: Mapped[str | None] = mapped_column(String(2048))
     # clock_timestamp(), not now()/func.now() -- the WS handler (ws/chat.py)
     # shares one AsyncSession for a whole connection's lifetime, and a
     # read-only op (e.g. a "join" frame's membership check) can leave a