server: queued chat delivery (paste and Enter) skips #624's write-time authority check #666

Found by the whole-release Codex (gpt-6.1-sol, xhigh) review of v0.4.3 (#664); not a release blocker: the race predates v0.4.3 and is the same in v0.4.2. Inferred from code, not reproduced live.

server/index.ts around lines 646 and 652 (dispatchPendingText): the pending-message paste and its Enter call paneSendText without the guard that #624 added to the other input paths. If the sender detaches, switches roles, disconnects or is revoked after authorizePending() but before Bun.connect() resolves, herdr still receives the write; at the Enter boundary that can commit a message the user had just cancelled.

Possible fix: pass a lease-aware guard to both RPCs; treat a cancellation before the paste as unsent and one after the paste as uncertain (the pending list already has an uncertain state). Tests: both delayed-connect boundaries. Related: #545, #624, #628, #635.