Add direct messages (#52)

A DM is a Room with a new is_dm flag, not a separate model -- reuses
all the membership/message/WS plumbing Room already has instead of
duplicating it. The room's `name` (still required + globally unique)
is an internal, never-displayed token derived deterministically from
the two participants' sorted user IDs (dm_room_name), which makes
find-or-create a single indexed lookup and gets free race-condition
safety from the existing unique constraint -- a concurrent double-
start from both people just hits the same IntegrityError->retry-as-
lookup path create_room already established.

Both participants get the plain 'member' role (no owner/admin
distinction makes sense for a 1:1 DM), which incidentally reuses
every existing role gate to block add-member, room-settings edits,
and join-via-browse on a DM for free. update_room also gets an
explicit is_dm guard independent of that, since renaming a DM isn't
just a privacy concern -- it would silently corrupt the find-or-create
invariant. DMs are excluded from both Browse Rooms and the admin
portal's room listing (fully private, per scope).

GET /api/rooms/mine precomputes each DM's other participant (name,
avatar, presence) as dm_partner in one batched query, so the sidebar
can render a DM row without a fetch per row. Frontend: a new "Direct
Messages" sidebar section (searchable by partner name, not the
internal room name), clicking someone in the People list starts or
resumes a DM, and the chat header/composer/RoomInfoPanel all render
the partner's identity instead of a room name where it's a DM.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/components/Sidebar.tsx

@@ -25,7 +25,21 @@ export function Sidebar({
   unavailableOffline,
 }: SidebarProps) {
   const query = searchQuery.trim().toLowerCase()
-  const filtered = query ? rooms.filter((r) => r.name.toLowerCase().includes(query)) : rooms
+  // A DM's `name` is an internal token, never what a user would search for
+  // -- matched against the partner's display name/username instead.
+  function matchesQuery(room: MyRoomItem): boolean {
+    if (!query) return true
+    if (room.is_dm && room.dm_partner) {
+      return (
+        (room.dm_partner.display_name ?? '').toLowerCase().includes(query) ||
+        room.dm_partner.username.toLowerCase().includes(query)
+      )
+    }
+    return room.name.toLowerCase().includes(query)
+  }
+  const filtered = rooms.filter(matchesQuery)
+  const directMessages = filtered.filter((r) => r.is_dm)
+  const regularRooms = filtered.filter((r) => !r.is_dm)
 
   const { width, startResize } = useResizableWidth({
     storageKey: 'sidebar-width',
@@ -83,9 +97,24 @@ export function Sidebar({
           </p>
         ) : (
           <>
-            {filtered.length > 0 && <div className="sidebar-section-label">Rooms</div>}
+            {directMessages.length > 0 && (
+              <>
+                <div className="sidebar-section-label">Direct Messages</div>
+                <nav>
+                  {directMessages.map((room, i) => (
+                    <RoomRow
+                      key={room.id}
+                      room={room}
+                      colorIndex={i}
+                      active={room.id === activeRoomId}
+                    />
+                  ))}
+                </nav>
+              </>
+            )}
+            {regularRooms.length > 0 && <div className="sidebar-section-label">Rooms</div>}
             <nav>
-              {filtered.map((room, i) => (
+              {regularRooms.map((room, i) => (
                 <RoomRow
                   key={room.id}
                   room={room}