Toggle an emoji reaction on a message.

🔒 Had no conversation/channel-membership check at all, and trusted a client-body user_id outright — any logged-in caller could react to (or silently un-react) any message anywhere, forging another user's reaction by naming their id. Authorization is on the CALLER (the token), never on the client-supplied user_id — same pattern as every other endpoint in this file/session that accepts a body-supplied identity.