#40711 feat: extend 4 REST endpoints + migrate 7 DDP callers

Summary

Second batch of the DDP→REST caller migration. Adds three small REST endpoint extensions (so the client can stop hitting DDP for these flows) and swaps six client call-sites over to REST. Each DDP method stays registered on the server with a deprecation log pointing at the REST route — external SDK / mobile clients keep working until the 9.0.0 sweep removes them.

The subscriptions.read tmid extension and its thread read-marker callers (ThreadChat.tsx, useThreadMessagesQuery.ts) were split out into #40957.

REST endpoint changes

Endpoint	Change
POST /v1/chat.delete	Body now accepts { fileId, asUser? } as an alternative to { msgId, roomId, asUser? }. When fileId is supplied the server resolves the owning message via Messages.getMessageByFileId.
POST /v1/users.setPreferences	data.utcOffset (number) is now accepted. Server writes to the user-document root via Users.setUtcOffset (not the settings.preferences subdoc), matching the legacy DDP behavior.
GET /v1/spotlight	Now accepts usernames (CSV), type (JSON-encoded { users?, mentions?, rooms?, includeFederatedRooms? }) and rid. Response items expose nickname/outside/uids/usernames/fname that DDP already returned. status on user items is optional (outside/federated users never had one). authRequired flipped to false to keep Accounts_AllowAnonymousRead flows working.

Caller migrations

DDP	REST	Caller(s)
loadMissedMessages	GET /v1/chat.syncMessages	useLoadMissedMessages.ts (maps each result through mapMessageFromApi)
joinRoom	POST /v1/channels.join	hooks/useJoinRoom.ts, lib/chats/data.ts (channel-only; non-c rooms error via REST same as DDP)
userSetUtcOffset	POST /v1/users.setPreferences	client/startup/startup.ts (2 sites)
deleteFileMessage	POST /v1/chat.delete	useDeleteFile.tsx
spotlight	GET /v1/spotlight	useSearchItems.ts, ComposerPopupProvider.tsx
listCustomSounds	GET /v1/custom-sounds.list	CustomSoundProvider.tsx

A TODO(ddp-removal) comment on useJoinRoom and data.ts flags the spot where we'd want a type-agnostic /v1/rooms.join later.

Test plan

• Disconnect/reconnect with an open channel → missed messages load.
• Open a non-subscribed public channel → join button works.
• Login from a new device on a different timezone → user.utcOffset updates.
• Delete a file message from the Files tab.
• Search a username/channel from the navbar.
• Mention @user / #room from the composer.
• Anonymous-mode workspace (Accounts_AllowAnonymousRead) → navbar search resolves general.
• Sound preferences pick up workspace custom sounds.

Task: ARCH-2164