fix: resolve multiple upstream issues from spacebarchat/server and MelodyChat/Harmony

[devin-ai-integration]

Summary

Fixes 9 open issues from upstream spacebarchat/server and MelodyChat/Harmony that weren't already addressed in anticensor:

Duplicate embed events (spacebarchat#1550): fillMessageUrlEmbeds previously emitted MESSAGE_UPDATE unconditionally (multiple times per message). Now only emits once, and only when embeds actually changed:

- let messageUpdateLock = saveAndEmitMessageUpdate(message);
- await getOrUpdateEmbedCache(uniqueLinks, async (url, embeds) => { ... messageUpdateLock = saveAndEmitMessageUpdate(message); });
- await saveAndEmitMessageUpdate(message);
+ let embedsChanged = false;
+ await getOrUpdateEmbedCache(uniqueLinks, async (_url, embeds) => { ... embedsChanged = true; });
+ if (embedsChanged) await saveAndEmitMessageUpdate(message);

Slowmode on typing (spacebarchat#1662): Added rate_limit_per_user enforcement to POST /channels/:id/typing matching the pattern used in message creation.

Role permission defaults (spacebarchat#1545): New roles without explicit permissions now inherit @everyone permissions AND-masked with requester permissions (preventing privilege escalation):

permissions: body.permissions
    ? String((req.permission?.bitfield || 0n) & BigInt(body.permissions))
    : String((req.permission?.bitfield || 0n) & BigInt(defaultPermissions))

DM recipients (spacebarchat#1339): createDMChannel now always excludes the creator from the returned recipients (previously only excluded for group DMs, not 1:1 DMs).

NameValidation field errors (spacebarchat#1664): ValidateName(name, field, maxLength?) now accepts a field name parameter and optional max length, throws FieldErrors with the correct field key instead of generic HTTPError.

Webhook name length: Webhook callers now pass maxLength: 80 to ValidateName, matching Discord's 80-char webhook name limit (previously capped at 32 like usernames).

public_flags type (spacebarchat#1553): MinimalPublicUserDTO and relationship endpoints now coerce public_flags through Number() to prevent bigint strings leaking into JSON responses.

Embed footer text (spacebarchat#1578): Embed.footer.text is now optional in the schema.

Nickname length (#40): Added 32-character limit to Member.changeNickname and the PATCH member endpoint.

Message order (spacebarchat#1628): Messages fetched with ?after= are now re-sorted DESC before returning.

---

• Reviewer: Verify slowmode enforcement on typing matches expected Discord behavior
• Reviewer: Verify DM channel recipients change doesn't break existing client expectations
• Reviewer: Confirm role permission AND-masking with requester bitfield is safe for normal flows
• Reviewer: Check that embed event deduplication doesn't miss legitimate embed updates
• Reviewer: Validate nickname limit of 32 and webhook name limit of 80 are correct per Discord API spec

Link to Devin session: https://app.devin.ai/sessions/11a7828a7f8c465f9f5ff18e424fff04
Requested by: @erkinalp

[devin-ai-integration]

Original prompt from Erkin

@erkinalp/anticensor let's solve the open issues from spacebarchat/server and melodychat/harmony that aren't already solved in our branch

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring