Request lifecycle
=================

1. The browser sends a form, JSON, multipart, or WebSocket request to the
   single application listener.
2. ``net/http`` dispatches it to the route registered in ``main.go``.
3. The domain handler authenticates the session when required, validates path
   identifiers and input, and checks account standing or membership.
4. Parameterized SQL queries read or update MySQL/MariaDB data.
5. JSON responses use the documented status codes; page forms may redirect.
6. Message creation broadcasts the resulting message to connected WebSocket
   clients after persistence succeeds.

Access failures intentionally use ``404`` for resources that the caller
cannot access in several membership-scoped endpoints, avoiding resource
disclosure.