requireAuth treated every chat caseId as a real cases row and rejected
"general" (the no-file chat sentinel) with 403. general chat now skips
the ownership check and is answered without touching chat_messages,
since that table's case_id is a NOT NULL FK to cases.