Chat sample: UI polish (uploads, emojis, typing, read-receipts)

[pathosDev]

Followup from the chat sample (`examples/chat/`). A grab-bag of
nice-to-have client-facing features that aren't in v1.

Items

• File uploads: object-storage-backed. Frontend posts a binary
  WS frame; server stores in `FilesystemObjectStorageBackend` (or
  S3) and broadcasts a `{ type: 'attachment', url, filename }`
  message.
• Emojis: client-side picker (e.g. `emoji-mart`); server is
  agnostic — text payload carries the unicode char.
• Typing indicators: ephemeral `{ type: 'typing', room }` →
  broadcast `{ type: 'user-typing', room, username }`; auto-times-out
  after 3 s. Not persisted.
• Read receipts: track per-user "last seen sequence" in DD-LWWMap
  (`read-up-to.` → roomName → seq). UI shows ✓✓ next
  to seen messages.

These can land as separate sub-PRs once any of them is needed.

Source: `examples/chat/` README → "Out of scope" section.

[pathosDev]

Closing as completed in three slices over the chat-sample sweep:

• Typing indicators (slice 1) — landed in fd96a30:
  Demonstrates ephemeral PubSub via the room's existing topic,
  { type: 'typing', room } → { type: 'user-typing', room, username } with server-side self-echo filter, 1/2 s client
  debounce, and 3 s auto-clear. DM typing routed via the recipient's
  inbox topic.
• Emoji passthrough (slice 1) — same commit:
  Server is text-agnostic; documented in the chat README that any
  Unicode emoji flows like plain text and each frontend can wire any
  picker (emoji-mart / <emoji-picker-element> / …) on top
  without server changes.
• Read receipts (slice 2) — landed in 17a77a8:
  Per-room DistributedData LWWMap (read-up-to.<room> → username →
  ts) with a monotonic guard in the new ReadReceiptsActor so stale
  client writes can't roll a pointer backwards. Frontends render
  ✓ / ✓✓ on own messages, tooltip lists readers. DMs share the
  same view via the canonical pair-id key.

The remaining sub-feature — file uploads — has been spun off as
#292 because it carries qualitatively different complexity (object-
storage wiring, signed URLs, content-type sniffing, orphan-blob GC)
than the other three.

Smoke-test coverage extended to passes 5 (typing) and 6 (read
receipts including a monotonic-guard probe).