Add admin-curated visual reaction packs to rooms

[jusso-dev]

Context

Adapt the safe catalog and compact composer ideas from Buzz PR #2968 for Muster rooms. Visual reactions can help teams acknowledge or humanise high-pressure collaboration, but they must never blur formal alert, investigation, task, approval, or response state.

Proposed behaviour

• Add an optional compact reaction-pack picker to the room composer.
• Support organisation-admin-curated packs only; clients must not fetch arbitrary pack definitions or assets from external content.
• Store pack metadata, approved revision, organisation scope, and lifecycle in PostgreSQL. Store verified assets in the existing object store using content-addressed SHA-256 keys.
• Validate MIME type, dimensions, animation/frame count, and byte size before approval or use. Pin and verify the exact approved asset digest.
• Provide accessible alt text and deterministic unavailable states.
• Keep visual reactions decorative. They must not acknowledge alerts, approve actions, complete tasks, change case state, or become authoritative evidence.
• Record pack creation, revision approval, removal, and external import attempts in the audit trail. Dangerous external imports require server-side capability checks and approval records.

UI direction

Keep this as simple as Buzz: one small composer affordance and one lightweight picker. Empty state points to organisation settings. Pack authoring/curation stays in settings; no marketplace or discovery feed in the main room UI.

Acceptance criteria

• Picker is absent or unobtrusive when no packs are installed.
• Users can send a reaction from an installed, approved pack in two interactions or fewer.
• Only exact approved revisions and verified assets render.
• All catalog and asset queries are organisation-scoped.
• External content is handled as untrusted data and cannot supply instructions.
• Superseded or missing pack revisions remain removable by administrators.
• Decorative reactions cannot mutate structured operational state.
• Alt text, keyboard navigation, reduced motion, empty state, and failed-asset state are covered.
• Tests use synthetic packs/assets and cover digest mismatch, oversized media, unauthorised access, and stale approval.

[jusso-dev]

Parent: #21

[jusso-dev]

Implemented, validated, deployed, and live-proved on main.

Commits:

• 235ef98fa373e508e42e51b3931564c1131d604a — governed reaction-pack domain, storage, API, UI, accessibility, approval, audit/outbox, tests
• e900cb6f048ef3d76d8b6078bf6621d94875fcf0 — CI object-storage provisioning
• 24ed0d8022f64602bd67d3314a2ca3070bea5834 — Sharp/libvips standalone runtime tracing
• 6d82ec4dd81f85f921e8fc2a800b3143c6ea1365 — revocable asset delivery and regression coverage

Proof:

• Local pnpm check: all 22 packages green; web unit 52 passed / 18 skipped; build green.
• PostgreSQL integration: 6/6.
• Focused real Chromium + MinIO: 2/2.
• Clean-install migration verification: 31 operational tables empty.
• Final CI: https://github.com/jusso-dev/Muster/actions/runs/30224820716 — 23 passed / 1 skipped.
• Final Security: https://github.com/jusso-dev/Muster/actions/runs/30224820803 — CodeQL, dependencies, secrets, Trivy, SBOM green.

Deployed:

• Image ghcr.io/jusso-dev/muster:sha-6d82ec4
• Digest sha256:742f1e02c03622843dc10414df8329e0f23a0aa46a130c96f66242e0208be052
• Web, worker, agent gateway healthy; zero restarts.

Live Chromium proof on port 3004:

• Admin uploaded a synthetic two-frame GIF.
• Server verified exact SHA-256 and frame count.
• Exact revision approval succeeded.
• Authenticated asset returned the expected MIME, ETag, digest, and bytes.
• Room picker sent in two interactions.
• Reduced-motion and Escape behavior passed.
• Anonymous catalog access returned 401.
• Removal preserved metadata/audit history.
• Final deployed revision rendered the removed message deterministically unavailable; exact revoked asset URL returned 404.

The rollout surfaced two production-only defects before closure:

• Distroless standalone omitted Sharp/libvips native files; tracing fixed and runtime-proved.
• Immutable browser caching could retain removed assets; delivery now revalidates and regression coverage locks revocation behavior.

Recovery:

• Dump /home/justinmiddler/muster/backups/muster-before-issue26-235ef98-20260726T224246Z.dump
• SHA-256 f8b2b4f2a26a8ac1126e1c1088bbd3c062ed20c505dd092ebff4c767c49f2327
• Environment backup and rollback image retained.

Post-proof counts: rooms 26; memberships 67; messages 113; tasks 10; evidence 9; audit 312; outbox 262; reaction packs/revisions/assets 1/1/1. The synthetic reaction and removal history remain intentionally append-only.

Port-3010 handbook updated and verified HTTP 200.