fix: Improve plugin ui entry points, Fix chat scroll, fix notifications, fix user rights

toju-app/src/app/domains/direct-call/README.md

@@ -13,4 +13,6 @@ Direct calls coordinate private voice sessions started from people cards, direct
 7. Joining, leaving, ending, participant additions, and call chat conversion updates are mirrored as `direct-call` events over the same P2P/signaling fallback path used by direct messages.
 8. The server rail shows call icons only while at least one participant is joined. If a user is viewing a private call after the session ends, the route returns to the call's chat view.
 
+Incoming `direct-call` events are ignored unless the current user is declared in the event's `participantIds` or participant profiles, so only invited PM/group-call participants can receive call audio, the in-app incoming-call modal, or a desktop ring notification.
+
 Two-person calls use the one-to-one direct-message conversation id as their call id. Converted group calls keep the original call id for media routing but point `conversationId` at the new group chat so active streams stay connected while the chat history boundary changes.

toju-app/src/app/domains/direct-call/application/services/direct-call.service.spec.ts

@@ -87,6 +87,17 @@ describe('DirectCallService', () => {
     expect(context.service.incomingCall()).toBeNull();
   });
 
+  it('ignores incoming call events when the current user is not a participant', async () => {
+    const context = createServiceContext({ currentUser: charlie, allUsers: [alice, bob, charlie] });
+
+    context.directCallEvents.next(createCallEvent('ring', alice, ['alice', 'bob']));
+
+    await vi.waitFor(() => expect(context.service.sessionById('dm-alice-bob')).toBeNull());
+    expect(context.audio.playLoop).not.toHaveBeenCalled();
+    expect(context.directMessages.createConversation).not.toHaveBeenCalled();
+    expect(context.directMessages.createGroupConversation).not.toHaveBeenCalled();
+  });
+
   it('answers an incoming call from the modal action', async () => {
     const context = createServiceContext({ currentUser: bob, allUsers: [alice, bob] });
 

toju-app/src/app/domains/direct-call/application/services/direct-call.service.ts

@@ -355,6 +355,10 @@ export class DirectCallService {
       return;
     }
 
+    if (!this.callPayloadIncludesParticipant(payload, meId)) {
+      return;
+    }
+
     const participants = this.callParticipantsFromPayload(payload);
     const existing = this.sessionById(payload.callId);
     const incomingSession = this.createSession({
@@ -671,6 +675,11 @@ export class DirectCallService {
     ]);
   }
 
+  private callPayloadIncludesParticipant(payload: DirectCallEventPayload, participantId: string): boolean {
+    return payload.participantIds.includes(participantId)
+      || (payload.participants ?? []).some((participant) => participant.userId === participantId);
+  }
+
   private groupConversationTitle(session: DirectCallSession): string {
     const names = Object.values(session.participants)
       .map((participant) => participant.profile.displayName || participant.profile.username || participant.userId);