fix(dm): Enter-to-send, move DMs to left rail, monotonic publish version

[sanity]

Three fixes after the #244 production release surfaced real UX issues with first users (zorolin tried DMs in the official room and surfaced both Enter-to-send and the buried entry point).

1. Enter-to-send in the DM composer

The DM textarea ignored Enter; only the Send button worked. The room-message composer already had Enter-to-send / Shift-Enter-newline; this PR mirrors it.

Refactored the existing send closure into a no-arg do_send callable so both onclick (button) and the new onkeydown (Enter) invoke the same path.

2. "Direct Messages" section in the left rail under Rooms

zorolin's feedback: the previous DM entry point — a button in the Members panel — was confusing, and per-room-only made cross-room DMs invisible. Both Ian and zorolin agreed DMs belong in the left rail next to Rooms.

• New components/room_list/dm_rail_section.rs renders a flat list across ALL rooms. Each row: peer nickname + room name + unread badge. Sorted unread-first, then most-recent.
• Hidden when empty.
• Click a row → opens the existing DmThreadModal for that (room, peer).
• Removed the now-redundant button from members.rs and dropped the unused DmInboxModal + DM_INBOX_OPEN signal + open_dm_inbox helper.

3. Monotonic counter for the web-container publish version

The seconds / 60 scheme failed on 2026-05-16: on-network version had drifted ahead to 30000208 (likely a past clock-skew bump that stuck), timestamp gave 29649402, fdev rejected the publish. Recovery required guessing a number ahead of all past values.

Replaced with published-contract/contract-version.txt — committed counter, incremented by cargo make sign-webapp each publish and committed alongside. Same pattern in test-contract/contract-version.txt for the test path.

Updated AGENTS.md, .claude/rules/river-publish.md, and the global ~/.claude/skills/river-publish/SKILL.md (pushed to ~/.claude in commit 5f22880).

What's deferred (not in this PR)

• Outbound DM plaintext persistence → feat: persist outbound DM plaintext in the chat delegate #256 (needs chat-delegate WASM bump + legacy_delegates.toml migration entry). Another agent is taking that one.
• Test-publish sed-replace WASM corruption when test contract ID ≠ 43 chars → test-publish: webapp sed-replace ID-length mismatch corrupts WASM #257 (blocked Playwright verification for this PR; not a production-path issue).

Testing

• cargo check -p river-ui --target wasm32-unknown-unknown --no-default-features ✓
• cargo test -p river-ui --bins --no-default-features components::direct_messages::tests ✓ (3 tests pass)
• Manual Playwright verification was blocked by test-publish: webapp sed-replace ID-length mismatch corrupts WASM #257 (test contract WASM corruption); the Enter handler mirrors the proven room-message pattern and the rail is a use_memo-driven read-only view, so the risk surface is small. Will visually verify against production after merge.

Closes (none — three separate concerns bundled because they're all small UX iterations from the same release).

[AI-assisted - Claude]

[sanity]

Pass 1 review consolidated (code-first + skeptical + Codex):

Fixed in dcd4c06:

• Skeptical High: counter-bump-before-publish risked drift if publish failed. Now sign-webapp writes a .prev snapshot, and publish-river / publish-river-debug / publish-river-test roll back the counter file from .prev if fdev publish fails (snapshot is gitignored). Concurrent-publish unsupported; documented (wrap in flock if you need it).
• Skeptical Medium: DM_LAST_SEEN unread-flash on first hydration → latch DM_LAST_SEEN_SEEDED = true synchronously inside the defer body before the write.
• Code-first / Skeptical Medium: stale DmInboxModal reference in direct_messages.rs module docstring → updated to describe the rail section.

Codex P1 false positive: do_send captured into two move event handlers — Dioxus's rsx! macro wraps these in EventHandler<T> (Rc-boxed) so each closure captures independently. cargo check --target wasm32-unknown-unknown is clean; same pattern works in conversation.rs::message_input.

Deferred (acceptable):

• O(rooms × dms) per render in rail (bounded).
• try_read subscription edge case (existing pattern across codebase).
• peer_still_member stale snapshot in Enter handler — do_send's own resolve_peer_vk is the source of truth; the handler-side gate just matches the visible disabled state.

[AI-assisted - Claude]