fix(conversations): authorize SSE room joins

[rissrice2105-agent]

Closes #222.

Summary

• verify the authenticated internal user is an active conversation participant
• return HTTP 403 before adding unauthorized users to SSE rooms
• cover successful joins and denied non-participant joins

Validation

• 18/18 related Vitest tests passed (join, message load/send, and typing routes)
• ESLint passed for the changed route and test
• git diff --check passed