fix: wire permission checks into message/channel handlers

- Add CheckChannelPermission to permissions.Checker (layers channel overrides on top of role permissions)
- Refactor requireChannelAccess to accept required permission bitmap
- Message Create checks SEND_MESSAGES; List/Search check VIEW_CHANNEL
- BulkDelete uses Checker.CheckPermission for MANAGE_MESSAGES
- Channel handler List filters out channels user cannot view
- Remove dead checkPermission method from message handler
- Fix frontend avatar upload: parse response URL, call updateProfile

web/src/components/UserSettings.tsx

@@ -4,7 +4,7 @@ import { useAuthStore } from '../stores/auth.ts';
 import { usePushStore } from '../stores/push.ts';
 
 export function UserSettings() {
-  const { user, updateProfile, changePassword, isLoading, error, clearError, fetchMe } = useAuthStore();
+  const { user, updateProfile, changePassword, isLoading, error, clearError } = useAuthStore();
   const { isSupported, isSubscribed, subscribe, unsubscribe, checkSubscription } = usePushStore();
   const navigate = useNavigate();
 
@@ -81,7 +81,8 @@ export function UserSettings() {
         throw new Error(data?.message || data?.error || `Upload failed: ${response.status}`);
       }
 
-      await fetchMe();
+      const uploadData = await response.json();
+      await updateProfile({ avatar_url: uploadData.url });
     } catch (err) {
       setUploadError(err instanceof Error ? err.message : 'Upload failed');
     } finally {

web/src/stores/auth.ts

@@ -31,6 +31,7 @@ export type BlockedUser = {
 };
 
 export interface UpdateProfilePayload {
+  avatar_url?: string;
   display_name?: string;
   bio?: string;
   accent_color?: string;