diagram sharing phase 3: event-channel confidentiality (recipient-scoped routing)

[fabracht]

Phase 3 of diagram sharing (design: docs/design/diagram-sharing.md).

Problem

Change events still broadcast to all authenticated subscribers. A grantee can read a shared resource via CRUD, but any authenticated user still receives its live-update events — the pre-existing all-subscribers-see-all-events behavior. Under the "mutually untrusting tenants" threat model this is a confidentiality leak.

Scope

• Route change events to recipient-scoped topics (e.g. $DB/u/{recipient}/events/...) derived from the resource owner + its _shares recipients.
• Enforce with %u topic-ACL substitution (already supported in mqtt-lib) so a subscriber only receives events for resources it can see.
• mqtt-lib broker fan-out is off-limits; confidentiality must come from topic scoping + ACL, not from filtering at fan-out.
• Agent path first; cluster path tracked in cluster parity for diagram sharing #75.

References

• Design: docs/design/diagram-sharing.md (event confidentiality)
• TLA: specs/DiagramSharing.tla (InvEventConfidentiality holds for the design); specs/DiagramSharingCurrent.tla (current behavior violates it)
• Phase 1: add agent-mode diagram sharing #76 · Cluster parity: cluster parity for diagram sharing #75