fix(server): resolve golangci-lint contextcheck, errcheck, gocritic findings

contextcheck: add ctx context.Context as first param to ListVisibleChannels,
BlockUser, CreateDM, CreateInvite, UpdateProfile, SendMessage; pass r.Context()
from HTTP handlers and ctx from WS handler; replace context.Background() in
telemetry spans with the propagated ctx.

errcheck: suppress justified Close() errors — defer func(){ _ = rows.Close() }()
in sqlite_events.go (idiomatic; rows.Err() checked), _ = resp.Body.Close() in
host_http.go (body fully consumed), _ = f.Close() in host_ui.go (read-only fd).

gocritic/rangeValCopy: rewrite for _, ch := range all (line 60) to indexed loop
in ChannelService.ListVisibleChannels to avoid 144-byte per-iteration copy.

Server/plugin/host_http.go

@@ -120,7 +120,7 @@ func (r *Registry) HTTPDo(ctx context.Context, inst *Instance, req HTTPRequest)
 	if err != nil {
 		return nil, fmt.Errorf("plugin http: do: %w", err)
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 	// Cap body size so a hostile/large response cannot OOM the host. We
 	// LimitReader to maxResponseBytes+1 so we can detect truncation.
 	limited := io.LimitReader(resp.Body, maxResponseBytes+1)

Server/plugin/host_ui.go

@@ -98,7 +98,7 @@ func (r *Registry) AssetHandler(inst *Instance) http.Handler {
 			http.NotFound(w, req)
 			return
 		}
-		defer f.Close()
+		defer func() { _ = f.Close() }()
 		http.ServeContent(w, req, rel, info.ModTime(), f)
 	})
 }