v3: fixed roles propagation bug, fixed inconsistent file drop zone, fixed chat attachments wrongfully pruned, some visual tweaks

api/routes/ws.ts

@@ -64,16 +64,16 @@ router.get("/ws", async (ctx) => {
 
   const socket = ctx.upgrade();
 
-  const avatarMime = authPayload
-    ? getUserById(authPayload.userId).avatarMime
-    : undefined;
+  // Read the live user so the role reflects the DB, not the (possibly stale)
+  // role embedded in the 7-day JWT.
+  const user = authPayload ? getUserById(authPayload.userId) : undefined;
 
   const client: WsClient = {
     socket,
     userId: authPayload?.userId,
     username: authPayload?.username,
-    role: authPayload?.role,
-    avatarMime,
+    role: user?.role,
+    avatarMime: user?.avatarMime,
   };
 
   // Use addEventListener — more reliable than onopen= with Deno.serve