feat: enhance user presence and channel interaction features

- Fix userlist not refreshing after creating a new channel.
- Implement unmute timer with a background job to automatically unmute users.
- Improve userlist display by filtering invisible users and ensuring proper transitions between statuses.
- Add clickable usernames, @mentions, and #channels for easier navigation.
- Embed theme colors from source sites for a more cohesive UI.
- Introduce a stateful userlist that updates incrementally via SignalR events.
- Restrict auto-opening of files to safe types only, enhancing security.
- Refactor user management into a dedicated service to reduce code duplication.
- Add a MuteExpirationService to handle timed mutes.
- Update documentation with Mermaid diagrams for major flows.

docs/changelog/v0.2.8.md

@@ -7,6 +7,14 @@
 - Fix connection failure cleanup — `ConnectionManager.ConnectAsync` now properly disposes `ApiClient` and `EchoHubConnection` on any failure path (previously only cleaned up on saved-token auth failures)
 - Fix IRC gateway sending UTF-8 BOM on first message, breaking CAP negotiation and SASL auth for all clients
 - Handle `AUTHENTICATE *` (SASL abort) instead of crashing on invalid base64
+- Fix userlist not refreshing when creating a new channel — now fetches online users after channel creation
+- Fix unmute timer not working — add `MuteExpirationService` background job that proactively unmutes users when their timed mute expires (previously only checked on message send)
+- Fix missing space between mod/admin role icon and username in the userlist
+- Fix invisible users still visible in the userlist — `GetOnlineUsersAsync` now filters invisible users; server skips `UserJoined` broadcast for invisible users
+- Fix invisible→online transition — user reappears in cached userlist when switching from invisible back to a visible status
+- Fix thread safety — `_channelUsers` presence cache now protected by `Lock` to prevent races between SignalR events and background fetches
+- Fix `@mention` regex matching email addresses and `#channel` regex matching hex colors / issue numbers — both now use lookbehind and letter-requirement guards
+- Fix `ParseThemeColor` accepting non-hex characters — now validates `[0-9a-fA-F]` digits
 
 ## New Features
 
@@ -15,17 +23,31 @@
 - Auto-updater rollback — pre-update backup created automatically before each update; restore via File > Rollback menu or `--rollback` CLI flag
 - Update failure recovery — if an update fails mid-extraction, offers to restore from the backup immediately
 - Defensive Unix permission check — verify execute permission on startup after auto-update (defense-in-depth)
+- Clickable usernames — press Enter on a username in the userlist or message sender to view their profile
+- Clickable @mentions — press Enter on a message containing `@username` to open that user's profile
+- Clickable #channels — press Enter on a message containing `#channel` to join/switch to that channel; `#channel` references are now highlighted in chat
+- Embed theme colors — embed vertical border line now uses the source site's `theme-color` meta tag when available
+- Stateful userlist — user presence is cached per channel and updated incrementally via SignalR events instead of re-fetching the full list on every join/leave/status change
+
+## Security
+
+- Restrict file auto-open — only safe file types (video, PDF, text) are opened with the system default app; all other files are downloaded to temp without executing (prevents script execution via `.bat`, `.exe`, etc.)
 
 ## Refactoring
 
 - Extract `IUserService`/`UserService` — consolidate user registration, authentication, and profile management into a dedicated service, eliminating duplicated logic between `AuthController` and `ChatService`
 - IRC gateway now checks ban status during authentication (previously skipped)
+- EchoHubSpace directory updates — server now only sends user count when it actually changes instead of every 30 seconds
 
 ## Distribution
 
 - Add Chocolatey package — `choco install echohub` for Windows users, auto-published from CI on each release
 - Add Linux/macOS install script — `curl -sSfL .../install.sh | sh` with automatic OS/arch detection
 
+## Documentation
+
+- Add Flows section — Mermaid sequence diagrams documenting all major request/event flows (auth, connection, messaging, channels, moderation, file upload, link embeds, server directory) with inline code references
+
 ## CI
 
 - Add Docker workflow — builds and pushes multi-arch (`amd64`/`arm64`) server image to GHCR on release