Scope REST and websocket events to the caller's environments

[popen2]

Phase 1 (security) of the websocket scalability work. The websocket
previously broadcast every database change to every connected client with
no authentication, and the REST list/detail endpoints ignored the caller's
identity, so any authenticated user could read or be notified about objects
in environments they had no permission for.

Introduce a single AccessScope authorization layer (db/src/access.rs),
resolved once per request / per websocket connection:

• AccessScope::All for site admins and service identities (bots,
  in-cluster deployments); AccessScope::Envs(..) for regular users,
  limited to the environments they hold any permission in.

REST: every environment-scoped model (Deployment, DeploymentTask,
DeploymentResource, Env, Secret, EnvUserPermission, DeploymentPermission)
now applies the scope as a SQL filter inside the single paginated query
(no fetch-then-filter), and exposes find_scoped() for detail endpoints.
Out-of-scope objects return the same 404 as missing ones, so existence is
not leaked through status codes.

Websocket: the /api/v2/ws endpoint now requires authentication. Since
browsers cannot set an Authorization header on a WebSocket, the access
token is carried via the Sec-WebSocket-Protocol subprotocol. A
per-connection task filters the event firehose down to the events the
identity is allowed to see, resolving each event's environment on demand
and preserving event ordering.

Known limitation (to be addressed in a later phase): because events are
not enriched with their environment, DELETE events whose row is already
gone cannot be resolved and are withheld from restricted users (fail
closed).