fix: client perms, @everyone/@channel, docs, unit tests

- usePermissions ORs current user roles + @everyone only (not all server roles)
- cache myRolesByServer; load on active server; refresh after self role edit
- gate/notify @everyone and @channel; plain @username push; special mention UI
- refresh FEATURE_PARITY (DMs exist; drop stale critical gaps)
- README production deploy notes dumpster.service
- unit tests for permission bits and broadcast mention tokens

internal/message/handlers.go

@@ -256,6 +256,19 @@ func (h *Handler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Gate @everyone / @channel on MENTION_EVERYONE (owner/admin always pass).
+	if hasBroadcastToken(req.Content, "everyone") || hasBroadcastToken(req.Content, "channel") {
+		allowed, permErr := h.checker.CheckPermission(r.Context(), serverID, userID, permissions.MENTION_EVERYONE)
+		if permErr != nil {
+			http.Error(w, `{"error":"server error"}`, http.StatusInternalServerError)
+			return
+		}
+		if !allowed {
+			http.Error(w, `{"error":"missing permission: MENTION_EVERYONE"}`, http.StatusForbidden)
+			return
+		}
+	}
+
 	// Anonymous confessions: never store/broadcast the original /confess message.
 	if h.confess != nil {
 		if payload, handled := h.confess.TryConfess(r.Context(), serverID, userID, req.Content); handled {