fix(comms): send messages via a server action, derive identity server-side (SoC)

The chat composer inserted comms_messages straight from the browser with
CLIENT-SUPPLIED user_id/display_name/handle/space_id — a member could forge
another person's name/handle. Add a sendMessage server action that derives
identity from the session, verifies the channel belongs to the caller's space,
validates content, and logs the send. The optimistic insert + realtime
subscription are preserved, so latency is unchanged. loadMessages stays on the
browser client (the realtime subscription needs it) with a comment noting it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/validations/forum.ts

@@ -92,3 +92,10 @@ export const createChannelSchema = z.object({
   description: z.string().max(500).optional().nullable(),
   channel_type: z.enum(['general', 'area', 'ops', 'project']).default('general'),
 })
+
+// Only the channel and the text are client-supplied; sender identity and
+// space_id are derived server-side from the session (never trusted here).
+export const sendMessageSchema = z.object({
+  channel_id: z.string().uuid('Invalid channel ID'),
+  content: z.string().min(1, 'Message is required').max(4000),
+})