Validate typing conversation access

[phucnguyen1707]

Summary

• require authenticated users to be active participants before typing start/stop broadcasts
• return 403 for inaccessible conversations instead of emitting SSE events
• add regression coverage for rejected and allowed typing start/stop requests

Fixes #83.

Tests

• pnpm vitest run src/app/api/typing/route.test.js
• pnpm vitest run src/app/api/messages/send/route.test.js src/app/api/typing/route.test.js