fix: codex review — scope ack to user, deduplicate inbox entries

- ack_inbox now requires ?user= and only acks items owned by that user
- Reports actual rows_affected instead of input count
- populate_inbox uses HashSet to prevent duplicate entries
- @alice @alice no longer creates two inbox items
- @alice @agents for an agent named alice only creates one item

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/colony-cli/src/client.rs

@@ -90,7 +90,7 @@ impl ColonyClient {
     pub async fn ack_inbox(&self, ids: &[i64]) -> serde_json::Value {
         let body = AckRequest { ids: ids.to_vec() };
         let res = self.http
-            .post(self.url("/api/inbox/ack"))
+            .post(self.url(&format!("/api/inbox/ack?{}", self.config.user_query())))
             .json(&body)
             .send().await.unwrap_or_else(|e| { eprintln!("colony unreachable: {e}"); process::exit(1); });
         if !res.status().is_success() { self.handle_error(res).await; }