Convert im_webapp from static mock prototypes to real backend integration

Implements all 11 product chapters (auth, messaging, contacts, groups,
files/favorites, calls, workplace/reports, settings, security) against the
real /v1/im REST API and native Tinode WS protocol, replacing the hardcoded
mock data the ba8f48ee prototype commit shipped with. Adds src/lib/im-api.js
as the REST client, plus supporting fixes across messages-view.jsx and the
attachment/upload/download pipeline (wrong SDK auth headers, group topic
naming, seq/timezone edge cases) found via live end-to-end testing against
the real backend.

Backup checkpoint before reconciling with origin/dev's parallel rewrite.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

package.json

@@ -79,7 +79,9 @@
   "license": "Apache-2.0",
   "dependencies": {
     "firebase": "^12.15.0",
+    "jsqr": "^1.4.0",
     "libphonenumber-js": "^1.10.40",
+    "pinyin-pro": "^3.29.3",
     "qrcodejs": "^1.0.0",
     "react": "^18.3.0",
     "react-dom": "^18.3.0",