Feat/resource watches: Users can watch resource paths and stream the bell

[St4NNi]

Users subscribe to events on resource path prefixes and see matches in the bell as a transient activity feed. Subscriptions live on the user's notification inbox holder, holders publish their interest realm-wide, origin nodes match events locally and forward one record per interested holder, and the holder expands matches into per-subscriber inbox rows. Also adds the SSE stream endpoint so the bell updates live.

Stacked on #307 (feat/notifications); diff shows only the resource-watch commits.

Changes

• Adds watch subscription records and a keyspace on the user's notification inbox holder.
• Adds watch subscription CRUD on the holder with a per-user cap of 50 and normalized path prefixes; the path scheme is plain string-prefix matching on {bucket}/{key} and meta/{group_id}/{document_id}.
• Adds GET/POST /api/v1/notifications/watches and DELETE /api/v1/notifications/watches/{id}, served from any node via holder proxy over the notification transport.
• Adds a per-holder watch interest digest document with generation-stamped dirty markers, published debounced and last-write-wins realm-wide over document sync, mirroring the node-usage snapshots.
• Maintains an in-memory interest table on every node, refreshed from the reconcile handlers, so event matching never reads storage.
• Adds metadata_created and data_uploaded notification kinds.
• Emits watch events best-effort post-success from object put, multipart completion, and metadata create; an unmatched event writes nothing and the notification path can never fail the host operation.
• Forwards one node-addressed record per interested holder through a durable forward outbox; the holder expands it to per-subscriber transient inbox rows (30-day TTL, shared prune task) with deterministic record ids, so redelivery is idempotent and raw events are never persisted.
• Adds GET /api/v1/notifications/stream (SSE): a wake signal fires on fresh inbox writes and mark-read, the stream pushes unread counts when the holder is local, degrades to 5s holder-polling when remote, and re-resolves the holder every 60s so it survives re-ranking.
• Surfaces the capped flag in SSE unread events.
• Retries watch subscription deletes on transaction conflicts.
• Adds multi-node integration tests: a watch created via node A fires for an upload handled by node B and is visible via node C, unmatched events write nothing, and interest digests converge and retract. Plus unit coverage for routing, idempotent expansion, transport trust gating, and the SSE arms.

GitHub Issues

• Backend for [feat] User resource watches #304.
• Implements the live-stream half of [feat] Notification delivery: email and live stream #288; SMTP/email delivery and channel preferences are deferred.

Notes

Known alpha limitations, called out deliberately:

• Watch prefixes carry no read-ACL gate yet: any realm user can watch any prefix and observe realm-wide upload and metadata activity. Pending an explicit decision.
• Anonymous and system writes never emit watch events.
• Hot-prefix forward-rate capping is deferred per the issue.
• A holder re-rank orphans subscription rows on the old holder; same lifecycle gap as inbox history, belongs to the [feat] Placement core, NodeInfo and labels #261/[feat] Epoch transitions #264/[feat] Balancer and dead node handling #265 placement work.