feat(web): complete groups/contacts/favorites/settings/calls/system domains + extensive review-round fixes

Rounds out the full rewrite with the remaining feature domains: group
management (admin panel, mute, files, announcements, QR-based invite/join),
contacts (friend profile, add-friend, blocklist, new-friends), favorites
(real media rendering across text/image/video/voice/file/link), settings
(profile/security/privacy/general/about), calls (Agora-backed audio/video
signaling + call history), and system messages/file assistant.

Also folds in a large batch of live-verified fixes surfaced by repeated
fresh code-review passes and hands-on E2E testing against the real
backend, including: WS reconnect not resubscribing any topic after a
disconnect, missing x-im-client-mid on every send path (protocol
compliance for retry dedup), group mute/member-settings/self-profile
endpoint corrections, relationship-state type fixes across search/QR/
friend-profile, tenant-switch logout gap, password-policy now read from
the real per-tenant config instead of guessed, NavRail highlight/
aria-current desync, several call-state-machine races, and responsive
layout fixes across all four breakpoints (mobile/tablet/laptop/desktop)
including a full mobile rebuild of favorites, call UI, and the settings
home/sub-list split.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/lib/api/bootstrap.ts

@@ -6,13 +6,6 @@ export interface MessagePolicy {
   recall_window_seconds?: number;
 }
 
-export interface RealnameStatus {
-  required: boolean;
-  allow_skip: boolean;
-  remind_after?: string;
-  status: 'unverified' | 'pending' | 'verified' | string;
-}
-
 /** README §2.1's "固定置顶两项" -- topic names are fixed/well-known on this backend (confirmed:
  *  docs/IM-前后端对接文档.md:909, `file_assistant.topic:"slf"`, `system_messages.topic:"sys"`), not
  *  per-user values the client has to discover another way. */
@@ -29,7 +22,6 @@ export interface BootstrapEntry {
 export interface BootstrapConfig {
   message_policy?: MessagePolicy;
   limits?: { max_forward_targets?: number; [key: string]: unknown };
-  security?: { realname?: RealnameStatus };
   features?: Record<string, boolean>;
   permissions?: Record<string, boolean>;
   modules?: unknown;