Add direct messages between friends after the social MVP #189

Goal

Let accepted friends coordinate outside a room after the friendship, blocking, notification, retention, and abuse controls have proven stable.

Required contract before implementation

• Only accepted friends may start or continue a conversation.
• Blocking immediately prevents new delivery and hides actionable contact paths.
• Define retention, deletion, export, and account-removal behavior before storing messages.
• Add reporting/moderation and rate limits before broad enablement.
• Treat message content as sensitive: do not put it in analytics, routine logs, notification previews, or PostgreSQL metrics.
• Reconnect and multi-device delivery must reconcile from durable paginated history; Socket.IO is delivery, not the source of truth.

Acceptance criteria

• Complete a threat/privacy review covering minors, harassment, impersonation, spam, and moderation access.
• Define conversation/message schemas, cursor pagination, delivery/read semantics, and retention.
• Add authenticated APIs and realtime delivery with per-message authorization and idempotency.
• Add block/report/delete flows before enabling message composition.
• Add limits for message size, frequency, links, and duplicate/replayed sends.
• Add tests for unfriending/blocking races, ID tampering, reconnect, multiple tabs, retention, deletion, and rate limits.
• Roll out behind a separate feature flag with privacy-safe reliability metrics.

Dependencies

• Build the friend request, friendship, and blocking lifecycle #75
• Add a typed in-app notification inbox for social actions #105
• Harden and feature-flag the Friend System rollout #188

Non-goals

• Group chat.
• File/image uploads.
• End-to-end encryption claims without a separately reviewed design.
• Shipping as part of the Friend System MVP.