Finalize local message hashes and accept SHA-256 API references

[markmnl]

Local-only sends and reactions now acquire their protocol SHA-256 atomically with time_sent. Message mutations share a transaction and row lock, stage file writes, and return success only after commit. The shared finalizer retains the wire representation for subsequent federation and independently finalizes add-to batches.

Expose sha256/psha256 in message, list, WebSocket and structured thread responses, preserving message_sha256 as an alias. Message routes accept a numeric ID or SHA-256; request pid also accepts an original or batch hash while response pid remains numeric. Batch hashes are preserved as the actual wire parent, with participation checks for that branch. Numeric ID routes and numeric response fields remain available; batch-only participants must use their batch hash when composing replies.

Depends on markmnl/fmsgd#44 (the module pins its feature commit) and implements markmnl/fmsg#37. Upgrade the daemon/API/schema together with writers paused, then backfill existing local-only messages before resuming. The README documents the sequence. Docker integration: markmnl/fmsg-docker#21.

Validation: go build ./..., all Go tests, PostgreSQL integration tests (including concurrent sends/edits, rollback, commit rejection, hash authorization, batch replies and WebSocket payloads), race checks and vet passed. The coordinated Docker suite passed all 15 tests with challenges forced on, including local-only delivery followed by federation, compressed batches and notification-only code 11.