feat: direct messages

1:1 conversations (userAId < userBId dedup pair), messages,
per-participant read tracking (conversation_reads). Block relationship
is enforced on every send. UI: /messages list + /messages/[id] thread
(5s poll), MessageButton on profiles, unread-badged nav icon.

This completes the social-feature backlog: notifications, rate
limiting, blocking, reporting, search/discovery, mentions, DMs, plus
fixes for the recipe-visibility 404, follow race, and 2-level comment
thread cap found during the earlier audit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/app/(app)/u/[username]/page.tsx

@@ -17,6 +17,7 @@ import { Avatar, AvatarImage, AvatarFallback } from "@/components/ui/avatar";
 import { Badge } from "@/components/ui/badge";
 import { FollowButton } from "@/components/social/follow-button";
 import { BlockButton } from "@/components/social/block-button";
+import { MessageButton } from "@/components/social/message-button";
 import { getPublicUrl } from "@/lib/storage";
 
 type Params = { params: Promise<{ username: string }> };
@@ -113,6 +114,7 @@ export default async function UserProfilePage({ params }: Params) {
                   targetUsername={user.username!}
                   initialFollowing={isFollowing}
                 />
+                {!isBlocked && <MessageButton targetUsername={user.username!} />}
                 <BlockButton targetUsername={user.username!} initialBlocked={isBlocked} />
               </div>
             )}