feat(channel): /@handle route + hide composer in preview mode

- New /@handle route (channel.handle name) that maps to UserController@channel,
  so YouTube-style profile URLs work. Handle is the existing username
  slug for now; a dedicated `handle` column can land later if we want
  the two to diverge. {handle} is constrained to [A-Za-z0-9][A-Za-z0-9._-]*
  so arbitrary paths don't match this route.
- Composer on the Wall tab used Auth::id() === $user->id directly,
  which bypassed the $isOwner flip-to-false that preview-as-visitor
  does. The composer now also checks !$preview so previewing an
  owner's channel hides the post box as a visitor would see it.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

resources/views/user/channel.blade.php

@@ -414,9 +414,9 @@ $headerSocialMap = [
         {{-- ── LEFT: composer + feed ── --}}
         <div>
 
-            {{-- Composer (owner only) --}}
+            {{-- Composer (owner only, hidden when previewing as a visitor) --}}
             @auth
-            @if(Auth::id() === $user->id)
+            @if(Auth::id() === $user->id && !$preview)
             <div class="ch-composer">
                 <form action="{{ route('posts.store', $user->id) }}" method="POST" enctype="multipart/form-data" id="postForm">
                     @csrf

routes/web.php

@@ -185,6 +185,14 @@ Route::middleware(['auth', 'verified'])->group(function () {
 
 // Channel - public for viewing. {username} is the user's slug (non-sequential, safe to share).
 Route::get('/channel/{username?}', [UserController::class, 'channel'])->name('channel');
+// YouTube-style @handle alias. For now `handle` is just the existing
+// `username` slug — if the two ever diverge, flip the controller lookup
+// in UserController::channel() to prefer a dedicated `handle` column.
+// The {handle} segment must be url-encoded (e.g. /%40alice) OR plain `@alice`
+// — Laravel's router accepts both because `@` is allowed in URI path segments.
+Route::get('/@{handle}', [UserController::class, 'channel'])
+    ->where('handle', '[A-Za-z0-9][A-Za-z0-9._-]*')
+    ->name('channel.handle');
 
 // Post routes - auth required
 Route::middleware(['auth'])->group(function () {