feat!: remove direct messaging (chat)

E2EE direct messages, the chat dock, the Messages module, the message
WebSocket and its realtime registry, and the messages / message_keys
tables (migration 0097; the downgrade restores the empty schema). Prod
held two welcome notes, no message between people and one key — never
used (owner decision, E34). WebSocket now has no owner module: the lint
bans it everywhere. Privacy policy updated: it no longer promises E2EE
for a feature that is gone.

frontend/eslint.config.js

@@ -25,13 +25,13 @@ import playwright from "eslint-plugin-playwright";
 // a `-- <the invariant>` description (eslint-comments/require-description makes that mandatory).
 
 // E22 S4: every way out of the browser goes through the one module that LOGS it — a request line
-// with a request id (lib/http.ts), the upload XHR (lib/api/core.ts), the messages socket
-// (lib/messagesSocket.ts). A bare `fetch` elsewhere is a request the client log never sees, which is
-// exactly how the baseline survey found four. Each owner is exempt from its OWN global only.
+// with a request id (lib/http.ts), the upload XHR (lib/api/core.ts). A bare `fetch` elsewhere is a
+// request the client log never sees, which is exactly how the baseline survey found four. Each owner
+// is exempt from its OWN global only; a global with no owner (null) has no exempt file at all.
 const NETWORK_OWNERS = {
   fetch: "src/lib/http.ts",
   XMLHttpRequest: "src/lib/api/core.ts",
-  WebSocket: "src/lib/messagesSocket.ts",
+  WebSocket: null,
   EventSource: null,
 };
 const networkGlobals = (exempt) =>
@@ -495,7 +495,7 @@ const suppressionRules = {
 
 // The two type-aware rules (E32 D3: a curated pair, not strictTypeChecked — ~2000 hits there, none
 // real in the sample). A floating promise is a rejection nobody handles: the audit found two real
-// ones (ChatDock's device key store, VideoEditor's play()). `void` marks a deliberate fire-and-forget
+// ones (the chat dock's device key store, since removed, and VideoEditor's play()). `void` marks a deliberate fire-and-forget
 // whose callee reports its own failure. React Query's invalidate/refetch family never rejects
 // unless asked to (`throwOnError`), so those calls are known-safe by name.
 const typedRules = {