feat(frontend): chat tabs, flat SVG icons, upload autosave, per-user rights

- Chat rework: Chats (private DMs with user search, online dots, unread
  badges) and Team chats tabs; shared message component with reactions,
  edit, image attachments, message search and typing indicators
- Flat modern inline SVG icon set (no external dependency) replaces
  emoji chrome across nav, headers, buttons, tabs and settings
- Uploaded avatar/background images apply instantly (auto-save) with
  confirmation note; per-user permission matrix in dashboard members
- Login localized, invite header uses icon, comment header cleaned

docs/API.md

@@ -93,12 +93,20 @@ Content fields: `content_json` (TipTap JSON), `content_html` (rendered HTML).
 - `POST /workspaces/:id/members {email,role}` → pending invite + notification
   (workspace admin+ or `workspace.invite` permission)
 - `GET /invites/mine`, `POST /invites/:id/accept`, `POST /invites/:id/decline`
+- `GET /workspaces/:id/permissions`, `PATCH /workspaces/:id/permissions`
+  (per-user allow/deny/inherit overrides, workspace admin+)
 - `GET /notifications/mine?unread=1` → `{ notifications, unread }`
 - `PATCH /notifications/:id/read`, `POST /notifications/read-all`
 
 ## Chat / teams / groups / upload
 
-- `GET /chat/:workspaceId`, `POST /chat/:workspaceId {body}`, `DELETE /chat/message/:id`
+- `GET /chat/:workspaceId`, `POST /chat/:workspaceId {body,attachment?}`,
+  `PATCH /chat/message/:id`, `DELETE /chat/message/:id`, `GET /chat/:workspaceId/search?q=`
+- `GET /dm`, `POST /dm {user_id}`, `GET /dm/:id/messages`, `POST /dm/:id/messages`,
+  `PATCH/DELETE /dm/message/:mid`, `GET /dm/:id/search?q=`
+- `POST /reactions/toggle {target_type,target_id,emoji}` (chat + DM messages)
+- Socket: `chat:join`, `dm:join`, `chat:typing`, `dm:typing`, `presence:online`,
+  `chat:message/edited/deleted`, `dm:message/edited/deleted`, `reaction:updated`
 - `GET /teams/by-workspace/:id`, `POST /teams`, `PATCH/DELETE /teams/:id`,
   team members CRUD, `POST /teams/:id/workspace {name}` (team workspace + badge)
 - `GET /groups/by-workspace/:id` (seeds `Team Creators`), groups CRUD + members