Mark Chat Read

Mark a chat as fully read for the current user.

Upserts read_states watermark to now().

TOS-4678: no-ops entirely while impersonating, for the same reason POST /me/presence does. A read receipt asserts that this person saw this conversation, so an admin/owner browsing an identity's screen via act-as must not write one under that identity. Without the guard the web client - whose shared fetch attaches X-Impersonate-Identity-Id to every request - marks each chat read as it is opened, which (a) moves the real person's read_states watermark and silently clears their unread badges, unrecoverably, since the watermark is one timestamp with no history, and (b) writes an event_log chat.read row and broadcasts a read receipt to the other participants under the target's name, with no field recording that an impersonator did it. ChatsPage's "mark all visible read" fans out over every unread chat at concurrency 8, so one click wiped a whole inbox. Measured on production 2026-09-08: 5,152 of 41,684 chat.read events (12.4%) across 36 identities were written inside an act-as window.

The access check still runs first, so an impersonated call to a chat the target cannot see still 404s - only the write is skipped.