initial integration with roomy #141

Implemented the initial read-only Roomy integration for goals.

• Added additive setThreadSource, importMessage, and retractImport records, generated types, validation, deterministic fold projections, and member/admin retraction semantics.
• Added anonymous DID-resolved Roomy reads in the browser with bounded pagination and distinct empty, private, missing, malformed/partial, and unreachable states.
• Added goal-page attachment, refresh, plain-text message rendering, member-gated two-step import confirmation, durable imported-message display, and withdrawal.
• Kept live Roomy attachments and messages out of turn bundles. Only member-signed snapshots enter a separate bundle section labelled as untrusted external input.
• Added OAuth write scopes, shared CLI/browser commands with import-time re-fetching, reader tests, record fixtures, and an ADR documenting the trust boundary.

Checks: pnpm lint, pnpm test, and pnpm typecheck pass. The UI suite includes 95 structural tests and 865 Vitest tests; the frontend design detector reported no findings.

Branch: radial/impl-b5db5eee4cf1 Commit: 41caebf7c73b15d5d0a61aa3cb2ec03c3e5c9530 Pull request: Radial will open it from the pushed tangled branch; this forge has no PR CLI.

Remaining risk: Roomy is pre-1.0 and its XRPC response shapes may drift; all remote values are defensively parsed and fail closed, but a live public-room smoke test remains advisable.

Radial artifact