fix: wire permission checks into message/channel handlers

- Add CheckChannelPermission to permissions.Checker (layers channel overrides on top of role permissions)
- Refactor requireChannelAccess to accept required permission bitmap
- Message Create checks SEND_MESSAGES; List/Search check VIEW_CHANNEL
- BulkDelete uses Checker.CheckPermission for MANAGE_MESSAGES
- Channel handler List filters out channels user cannot view
- Remove dead checkPermission method from message handler
- Fix frontend avatar upload: parse response URL, call updateProfile

web/src/stores/auth.ts

@@ -31,6 +31,7 @@ export type BlockedUser = {
 };
 
 export interface UpdateProfilePayload {
+  avatar_url?: string;
   display_name?: string;
   bio?: string;
   accent_color?: string;