feat: message reactions + link/image previews

Reactions (full stack):
- Wire: MsgReaction peer message (reaction_mid, reaction_emoji)
- Store: reactions table (mid, emoji, from_peer), SaveReaction, ReactionsForRoom
- Daemon: CmdSendReaction IPC command; EvtReaction IPC event; stored reactions
  replayed to newly-connected IPC clients alongside history
- Web UI: reactions state (mid → emoji → [fromId]); hover a message to reveal
  a + button; click opens a 6-emoji picker (👍❤️😂😮😢🙏); reaction chips
  appear below the message with count and tooltip; own reactions highlighted

Link/image previews:
- URLs in message text rendered as clickable <a> links
- Image URLs (.jpg/.jpeg/.png/.gif/.webp/blob:/data:image) rendered as inline
  thumbnails (max 320×200px) below the link

Also scoped push notifications architecture in FUTURE.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

FUTURE.md

@@ -137,6 +137,19 @@ Web frontend (React, already built) + [Wails v2](https://wails.io) shell for nat
 | ✅ shipped | P2P message history gossip (EXT-007) — new peers receive recent history from first connected peer |
 | ✅ shipped | Date-aware timestamps in TUI and web UI |
 | ✅ shipped | Historical peer alias resolution in web UI |
+| 🔜 planned | Push notifications (PWA Web Push + service worker) |
+| 🔜 planned | Message reactions (emoji, full-stack gossip) |
+| 🔜 planned | Link rendering + image preview in messages |
+
+### Push Notifications (planned)
+The web UI is already a PWA (installable, has manifest). The missing half is a service worker + Web Push subscription:
+
+1. **Service worker** — intercepts `push` events and shows OS notifications via `showNotification()`.
+2. **VAPID key pair** — generated once by the daemon (`-vapid-key` flag); the public key is served to the browser so it can subscribe.
+3. **Subscription persistence** — the browser's `PushSubscription` JSON is sent to the daemon over IPC (`register_push` command). The daemon stores it per-network-per-peer.
+4. **Daemon relay** — when a `message_received` event fires with no active IPC WebSocket connection, the daemon POSTs a Web Push notification to the stored subscription endpoint.
+
+This keeps the architecture clean: the daemon already runs in the background; it becomes the notification relay. No third-party push server is required for self-hosted setups (coturn already in use for TURN; a lightweight Web Push POST is similar).
 
 ---