feat(chat): direct chats and groups between users in the pet's window

Server mode: a rail beside the pet's chat lists the pet, then the user's
direct chats (one per pair) and groups with unread counts, and + for a new
chat. A room shows its messages (group senders named), loads older pages,
and sends text, pasted / dropped / attached files (<= 10 x 25 MB; images
inline). A group's creator renames it and adds or removes people; anyone may
leave. A blue dot on the pet counts unread messages.

Only a room's members read or write it, an admin included (roomFor → 404).
Files are stored under server-made names in <data dir>/chat/<room>/ and
served to members only under a sandbox CSP + nosniff. chat_message /
chat_room frames reach exactly the ids in `to` (scope.exactAudience).
New tables chat_rooms / chat_members / chat_messages / chat_files (additive).

server/index.js

@@ -237,6 +237,7 @@ function createApp() {
   app.use("/api/projects", projectsRouter);
   app.use("/api/locks", locksRouter);
   app.use("/api/pets", petsRouter);
+  app.use("/api/chat", require("./routes/chat"));
   app.use("/api/snapshots", snapshotsRouter);
   app.use("/api/artifacts", require("./routes/artifacts"));
   app.use("/api/alerts", alertsRouter);