fix: wire permission checks into message/channel handlers

- Add CheckChannelPermission to permissions.Checker (layers channel overrides on top of role permissions)
- Refactor requireChannelAccess to accept required permission bitmap
- Message Create checks SEND_MESSAGES; List/Search check VIEW_CHANNEL
- BulkDelete uses Checker.CheckPermission for MANAGE_MESSAGES
- Channel handler List filters out channels user cannot view
- Remove dead checkPermission method from message handler
- Fix frontend avatar upload: parse response URL, call updateProfile

cmd/server/main.go

@@ -217,7 +217,7 @@ func main() {
 
 			// Messages (under channels)
 			r.Route("/channels/{channelID}/messages", func(r chi.Router) {
-				message.NewHandler(database.DB, hub, pushHandler, logger).RegisterRoutes(r)
+								message.NewHandler(database.DB, hub, pushHandler, logger, permissionsChecker).RegisterRoutes(r)
 			})
 
 			// Per-channel notification settings