fix(events): check stream identity against the stored account

[rrrodzilla]

Closes #207

Summary

GET /api/v1/forge/schemas/{schema}/events refused every login-minted token that carries a tenant chain with 403 Stream authorization is no longer valid. before sending any event. The live identity check (identity_valid in routes/events.rs) called auth_store.get_user(&claims.sub), but password and OAuth login mint sub = "user:<username>" while the auth store is keyed by the bare username. No local account was ever found, so:

• tenant-scoped callers (single or multiple memberships, with or without X-Active-Tenant) fell into the external-subject branch, which refuses any non-empty tenant chain;
• callers without a tenant chain (for example a platform admin with no memberships, or any account under disabled tenancy) were treated as external subjects, so deactivation and role changes never closed their streams.

A second defect sat behind the first: the tenant-scope middleware passes platform-admin claims through unscoped, so an admin's tenant_chain is the flat login-time membership set. The check still treated its last entry as an active tenant and expected a scoped role on top of the admin's roles. That kept an admin with a creator membership (for example the admin who created the first organization under creator_role = "owner") refused even after the subject fix.

Fix

• routes/auth.rs gains account_username(&Claims), beside refresh, as events: tenant users get 403 and the admin stream skips the account re-check, because the stream looks users up by the prefixed token subject #207 suggests. Refresh, /auth/me, and the stream (identity_valid and the handler's local_account) all resolve the stored account through it. It strips the user: prefix with user_id_from_sub, the mapping Cedar, ownership and creator membership already use. Every token the server mints sets username to that same value, so refresh and /auth/me behave as before.
• The external-principal arm (Ok(None), no local account, empty chain) is now decided from the resolved username, so it applies only to tokens that really have no User row.
• Share the middleware's rules instead of re-deriving them: tenant_scope::is_tenant_scoped (platform admins bypass tenancy) and tenant_scope::active_membership_roles (pure; add_active_membership_role now wraps it). The stream compares the token's roles with a pure expected_roles(global, tenant_roles, active) and only walks memberships and hierarchy for tenant-scoped callers.
• Docs: docs/events.md states that platform admins get account status and role rechecks only. CHANGELOG entry under Unreleased/Fixed, after the fix(cli): validate custom policies against the system schemas #213 entry.

Tests

New tests in crates/schema-forge-acton/tests/entity_events.rs drive the production path: real POST /auth/login, the PasetoAuth middleware serve installs, then tenant_scope. Accounts are seeded the way invite acceptance seeds them.

• login_tokens_open_streams_for_admins_and_tenant_members: platform admin with no memberships, platform admin with a creator owner membership, single-membership member, and a multi-membership user with scoped owner roles under X-Active-Tenant for each org, all open. The member receives an entity.updated change on its stream, and the scoped owner renames its org through its scoped grant and receives that change.
• login_streams_close_and_stay_refused_after_membership_changes: removing a membership, or demoting a scoped owner to member, closes the open stream with closed / authorization_changed and refuses reconnects with the old token. The user's other, unchanged scoped grant still opens.
• login_streams_close_and_stay_refused_after_account_changes: deactivating an admin, or removing platform_admin, closes the open stream the same way and refuses reconnects.
• Unit tests: account_username maps user:<name> to the stored account; expected_roles adds only the active membership's role; platform admins are never tenant-scoped.

These cover the three tests #207 lists. The existing fixture now uses the production subject (user:alice). That alone makes the existing tenancy and deactivation tests fail without the fix, so they exercise what production sends. Two actor assertions now expect user:alice, which is what production has always emitted. Waits for a close are bounded at 10 s (the idle recheck is at most 5 s), so a regression fails instead of streaming keep-alives until the runner kills it.

Without the fix: the three new tests and membership_removal_closes_stream_and_active_tenant_cannot_be_impersonated plus scoped_membership_role_allows_stream_and_role_revocation_closes_it fail, and idle_keep_alive_and_live_account_revocation never ends (killed after 875 s).

Regression?

No. The same three login-path tests, ported to a v0.48.0 checkout, fail the same way: the member stream is refused with 403, the admin holding a membership is refused, and the deactivated admin's stream stays open. The subject lookup has been wrong since events shipped in 0.48.0 (#206). 0.49.0 changed the role comparison but not the lookup.

Why a 0.48 admin could stream while a 0.49 admin could not: it depends on whether the admin holds a tenant membership, not on how the admin was created. serve --admin-user and schemaforge bootstrap-admin both call shared_auth::bootstrap_admin_with_display_name, which writes the same bare username and ["platform_admin"] with no memberships; only the display name differs. An admin with no membership logs in with an empty tenant chain and lands in the external-subject branch, which opens the stream but skips every recheck. 0.49.0 added [schema_forge.tenancy] creator_role; an admin who creates an organization under creator_role = "owner" gains an owner membership, logs in with a non-empty chain, and is refused. The founder@example.gov fixture models that admin.

Verification

• cargo nextest run -p schema-forge-cli -p schema-forge-acton --features schema-forge-cli/oauth,schema-forge-cli/sse (the CI SurrealDB job): 1267 passed, 4 skipped (Postgres-only, ignored)
• cargo clippy -p schema-forge-acton --features postgres,graphql,oauth,sse --all-targets -- -D warnings and cargo clippy -p schema-forge-cli --features oauth,sse --all-targets -- -D warnings: clean
• cargo test --doc -p schema-forge-acton --features graphql,oauth,sse: clean
• The stream check is backend-agnostic (a string lookup), so the new tests use in-memory SurrealDB. Adding a Postgres variant to the shared events_http namespace would race the existing Postgres events fixture.