fix(reply): scope cloud parent resolution

[andrei-hasna]

Summary

• Resolve numeric reply parents inside the independently supplied channel or session before consulting an unscoped numeric endpoint.
• Fall back to the legacy exact /messages?uuid= filter when an older server does not expose /messages/by-uuid/:uuid.
• Centralize channel extraction and fix the session-prefix offset used by the reply command.
• Add a cloud CLI regression where the numeric endpoint returns a colliding mementos row and the dedicated UUID route returns 404.

Refs: OPE104-00075

Test plan

• bun test src/cli/reply-reference-cloud-compat.e2e.test.ts src/lib/store/api-store.test.ts src/cli/reply-threading.e2e.test.ts src/cli/send-attachments-reply.e2e.test.ts — 62 pass, 0 fail, 248 expect()
• bun test — 1812 pass, 0 fail, 6395 expect()
• bun run typecheck
• bun run build
• git diff --cached --check
• gitleaks git --staged --redact --no-banner — no leaks found
• gitleaks git --log-opts="origin/main..HEAD" --redact --no-banner — 1 commit scanned, no leaks found

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

Independent adversarial review: GO at exact head 0548322e8815ca0535887d772eb1e7e23f7874a4 / tree 124c712fcc9355a60136b7f6ae7974a417e31574; zero in-scope P0/P1 behavior, security, integrity, or compatibility defects. Merge-ref tree is identical. Evidence: focused 81 pass / 0 fail; store/server 230 pass / 0 fail; typecheck and diff checks exit 0; CI and Swift macOS succeeded. Non-blocking P2 only: future callers must preserve the documented caller-side scope validation after a direct-ID diagnostic fallback.