[swarnendusahu10-dotcom]

What does this PR fix?

Closes #1288

Problem

getUserRoles() in EmbeddedChatApi.ts only ever called getUsersInRole("admin").
Server-wide moderators and owners were completely invisible — they received no badge at all.
A previous partial attempt merged all three roles into a single flat admins array,
which caused every moderator and owner to display an incorrect "Admin" badge.

Root cause

The function returned { result: response.users } — a flat list of only admin users —
and the caller mapped that list into admins[] in the Zustand store. There were no
moderators or owners slots in the store, and MessageHeader.js had no rendering
logic for those roles.

Fix

Changed getUserRoles() to fetch all three roles in parallel via Promise.all and
return them as separate typed arrays: { admins, moderators, owners }.

Four files changed:

• packages/api/src/EmbeddedChatApi.ts — correct return type + separated arrays
• packages/react/src/store/memberStore.js — adds moderators: [], owners: [],
  setModerators, setOwners to the Zustand store
• packages/react/src/hooks/useFetchChatData.js — destructures and stores each role
  array independently
• packages/react/src/views/Message/MessageHeader.js — renders a correct "Moderator"
  or "Owner" badge box alongside the existing "Admin" badge box

Why this change is necessary

Role badges are a trust signal. An embedded chat widget that shows the wrong badge
(or no badge) for a server Moderator or Owner undermines moderation visibility and
user trust — especially in support or community chat embeds where knowing who holds
authority matters. This is a correctness bug with a UX and moderation-trust impact.

Edge cases tested (45/45 pass)

• Admin-only user → "Admin" badge, no Moderator/Owner badge
• Moderator-only user → "Moderator" badge, no "Admin" badge
• Owner-only user → "Owner" badge only
• User with all three server-wide roles → all three badges shown independently
• No roles at all → no badge, no crash
• API returns success: false → gracefully returns empty arrays
• null / non-array users field → handled without crash
• username field missing on a user object → safely skipped
• Numeric username coerced to string correctly
• Promise.all failure → falls back to { admins:[], moderators:[], owners:[] }
• Channel-level moderator/owner (via getChannelRoles) → completely unaffected
• User who is both server-wide admin AND channel-level moderator → both badges shown

Security

• Badge text is hardcoded ("Admin", "Moderator", "Owner") — not from API → no XSS
• String(u.username) coercion + .filter(u => u?.username) guard → no __proto__ injection
• No new network endpoints; uses existing roles.getUsersInRole REST call
• Channel-level roles path (getChannelRoles / memberRoles) is untouched