feat(chat): unread read-receipts with lobby/game dot and history-open ack

Persist per-message read state as a chat_messages.unread_seats bitmask
(migration 00008): a text message seeds every recipient seat's bit, a nudge
only the awaited seat's. A seat's bit clears when the player opens the move
history or chat (POST /games/:id/chat/read, sent only when something is
unread), and a nudge additionally clears when its recipient answers by moving
(a wired game NudgeClearer, dependency-inverted so game keeps off social).

UI shows a per-viewer unread dot in the lobby (next to the opponent) and the
game score bar — the unread_chat game-view flag seeds it from authoritative
REST views, live chat/nudge events raise it. Opening the move history counts
as reading (even without entering chat): the 💬 fade-blinks twice and the
client acks. Admin Messages gains an unread-only filter, a read/unread column,
and a per-message card with the per-seat read breakdown. Observability:
chat_read_duration histogram + chat_unread_messages gauge + social tracing.

backend/internal/server/handlers_game.go

@@ -439,10 +439,16 @@ func (s *Server) handleListGames(c *gin.Context) {
 		return
 	}
 	memo := map[string]string{}
+	// One query seeds the lobby's per-card unread badge for every listed game.
+	var unread map[uuid.UUID]bool
+	if s.social != nil {
+		unread, _ = s.social.UnreadGames(c.Request.Context(), uid)
+	}
 	out := make([]gameDTO, 0, len(games))
 	for _, g := range games {
 		dto := gameDTOFromGame(g)
 		s.fillSeatNames(c.Request.Context(), &dto, memo)
+		dto.UnreadChat = unread[g.ID]
 		out = append(out, dto)
 	}
 	c.JSON(http.StatusOK, gameListDTO{Games: out, AtGameLimit: atLimit})
@@ -480,6 +486,22 @@ func (s *Server) handleNudge(c *gin.Context) {
 	c.JSON(http.StatusOK, chatDTOFrom(msg))
 }
 
+// handleChatRead marks every chat entry the caller has not yet read in the game as read
+// — the acknowledgement the client sends when the player opens the move history or chat
+// — and records each entry's publish-to-read latency. The client calls it only when it
+// believes something is unread, so the backend is not hit on every history open.
+func (s *Server) handleChatRead(c *gin.Context) {
+	uid, gameID, ok := s.userGame(c)
+	if !ok {
+		return
+	}
+	if _, err := s.social.MarkRead(c.Request.Context(), gameID, uid); err != nil {
+		s.abortErr(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, okResponse{OK: true})
+}
+
 // userGame reads the authenticated account and the :id game param, aborting with the
 // right status when either is missing. ok is false when the request was aborted.
 func (s *Server) userGame(c *gin.Context) (uuid.UUID, uuid.UUID, bool) {
@@ -504,5 +526,24 @@ func (s *Server) writeMoveResult(c *gin.Context, res game.MoveResult) {
 		return
 	}
 	s.fillSeatNames(c.Request.Context(), &dto.Game, map[string]string{})
+	if uid, ok := userID(c); ok {
+		s.setUnreadChat(c.Request.Context(), &dto.Game, uid)
+	}
 	c.JSON(http.StatusOK, dto)
 }
+
+// setUnreadChat fills the per-game unread-chat flag for viewer uid on one game's DTO,
+// when the social domain is present. It is best-effort: a lookup error leaves the flag
+// false (a missing badge) rather than failing the surrounding game response.
+func (s *Server) setUnreadChat(ctx context.Context, g *gameDTO, uid uuid.UUID) {
+	if s.social == nil {
+		return
+	}
+	gid, err := uuid.Parse(g.ID)
+	if err != nil {
+		return
+	}
+	if unread, err := s.social.HasUnread(ctx, gid, uid); err == nil {
+		g.UnreadChat = unread
+	}
+}