fix: DM message ordering, consolidate input toolbar, add rich text/WYSIWYG, file upload with drag-drop

- Fix DM backend ListMessages to use DESC + reverse (match channel handler)
- Remove spurious .reverse() from frontend message/conversation stores
- Create shared MessageInput component with Slack-style single toolbar row
- Add file upload via + button with progress bar and drag-and-drop
- Add markdown/rich text toggle with full WYSIWYG block formatting
  (lists, blockquotes, links, headings, code blocks)
- Add frontend+backend security for file uploads (extension + content-type guards)

web/src/stores/thread.ts

@@ -103,9 +103,11 @@ export const useThreadStore = create<ThreadState>((set) => ({
     set({ isLoading: true, error: null });
     try {
       const params = before ? `?before=${encodeURIComponent(before)}` : '';
-      const messages = await api.get<Message[]>(`/channels/${threadId}/messages${params}`);
+      const raw = await api.get<Message[]>(`/channels/${threadId}/messages${params}`);
+      // ponytail: API returns DESC (newest first), reverse to oldest-first
+      const msgs = (Array.isArray(raw) ? raw : []).reverse();
       set((state) => ({
-        messagesByThread: { ...state.messagesByThread, [threadId]: Array.isArray(messages) ? messages : [] },
+        messagesByThread: { ...state.messagesByThread, [threadId]: msgs },
         isLoading: false,
       }));
     } catch (error) {