fix: Improve plugin ui entry points, Fix chat scroll, fix notifications, fix user rights

toju-app/src/app/infrastructure/realtime/README.md

@@ -123,6 +123,8 @@ Room affinity is authoritative at this layer as well. The renderer repairs each
 
 Server-relayed fallbacks are intentionally narrow. Room chat (`chat_message`), direct-message events (`direct-message`, `direct-message-status`, `direct-message-mutation`), and voice presence (`voice_state`) may flow over signaling so users can still see written chat and voice roster state while P2P data channels are down. Media, attachments, message inventory sync, screen/camera state, and plugin data-channel traffic remain peer-plane responsibilities.
 
+Room-scoped chat intake is also guarded on receipt: a `chat-message` or chat sync payload is processed only when its `roomId` is the current room or one of the user's saved rooms. This keeps broad peer meshes from creating unread state or notifications for unrelated chat-servers.
+
 In UI/debug conversations, a **chat-server** means one of the saved rooms navigated from the server rail. Each chat-server has its own assigned signal server via `sourceId` / `sourceUrl`, and room-scoped feature/config checks must prefer that signal server before considering any global active endpoint. For example, KLIPY GIF picker visibility is resolved against the currently viewed chat-server's signal server so an unrelated offline chat-server does not hide the button everywhere.
 
 Cold-start routing now waits for the initial server-directory health probes so same-backend aliases can collapse to one canonical signaling endpoint before any saved rooms reconnect. When a room is reconnected on a chosen socket, its background rooms are re-joined on that same socket as well so stale per-signal memberships do not keep orphan managers alive, and reconnect replay only sends `view_server` for rooms that manager still has joined.