fix: chat duplication, lobby scroll, ban self-protection

- Chat: fix race condition where SSE delivers message before POST
  response, causing duplicate — now checks if real msg already exists
- LobbyManager: add max-h-72 + overflow-y-auto for long participant lists
- ModerationPanel: hide kick/ban buttons for yourself (useLocalParticipant),
  add max-h-80 + overflow scroll, show API errors instead of silencing
- Moderate API: reject kick/ban when targetSessionId === host userId

src/app/api/rooms/[roomId]/moderate/route.ts

@@ -45,6 +45,9 @@ export async function POST(
       if (!targetSessionId) {
         return NextResponse.json({ error: "targetSessionId required" }, { status: 400 });
       }
+      if (targetSessionId === session.user.id) {
+        return NextResponse.json({ error: "Cannot kick yourself" }, { status: 400 });
+      }
       await roomService.removeParticipant(lkRoom, targetSessionId);
       await prisma.participantHistory.updateMany({
         where: { roomId, sessionId: targetSessionId, leftAt: null },
@@ -57,6 +60,9 @@ export async function POST(
       if (!targetSessionId) {
         return NextResponse.json({ error: "targetSessionId required" }, { status: 400 });
       }
+      if (targetSessionId === session.user.id) {
+        return NextResponse.json({ error: "Cannot ban yourself" }, { status: 400 });
+      }
 
       // Find fingerprint from lobby entry or participant
       const lobbyEntry = await prisma.lobbyEntry.findFirst({