fix(0006b): scope JetStream ACL per-room, close $JS.API.> KV leak (audit 0008 N2)

The client-infra grant was {"_INBOX.>", "$JS.API.>"}. The broad "$JS.API.>" let
any registered peer drive the whole JetStream API and read the control-plane KV
buckets (KV_UNIBUS_users/rooms/members/room_keys) and the object store directly
over NATS, bypassing the HTTP authorization (requireMember + own-endpoint
checks): a full leak of the allowlist, room graph and sealed-key metadata once the
decentralized control plane is active.

Fix: replace the broad grant with a CLOSED, per-room allow set.
- clientInfraSubjects shrinks to {"_INBOX.>", "$JS.API.INFO"} ($JS.API.INFO is
  account counters only — no room/user/key contents).
- SubjectACLFor now grants, per room the peer belongs to, the room subject plus
  the minimal JetStream API subjects of THAT room's stream (jsSubjectsFor:
  STREAM.*, CONSUMER.*, $JS.ACK scoped to UNIBUS_<roomID>).
- Because KV_UNIBUS_* and OBJ_UNIBUS_* are never a room stream, they fall outside
  the closed allow set and are denied by default. Clients reach blobs over the
  HTTP control plane, not the NATS object store, so OBJ needs no client grant.

roomStreamName mirrors pkg/client.streamName so the authorizer and the producer
never drift.

Tests:
- TestAttack0008_N2: eve (registered, member of no room) cannot bind the KV users
  bucket nor subscribe $KV.UNIBUS_users.> (permissions violation); golden: the
  room owner can still drive her OWN room stream's JetStream API; edge: eve cannot
  reach a foreign room's stream.
- TestReaudit_H4 residual note updated: the $JS.API.> leak it deferred is closed.

CGO_ENABLED=0 go build/vet/test green; govulncheck 0 reachable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

pkg/membership/acl_test.go

@@ -229,14 +229,11 @@ func TestSubjectACLIsolation(t *testing.T) {
 //   - golden: the member still pub/subs her own room, and the non-member never
 //     captures that traffic.
 //
-// Residual (DOCUMENTED, not closed here): the client-infra grant includes
-// "$JS.API.>", shared by all peers so per-connection JetStream works. A peer that
-// subscribes specifically to "$JS.API.>" can still observe stream-management
-// requests whose subjects embed the stream name derived from a room id. Fully
-// closing that needs NATS accounts/permissions isolation per identity (deferred to
-// the 0003 decentralization line). The high-impact leak the auditor exploited —
-// the room subject itself and JetStream advisories captured via "Subscribe(\">\")"
-// — is closed.
+// Residual now CLOSED (issue 0006b, audit 0008 N2): the client-infra grant no
+// longer includes "$JS.API.>". JetStream API access is granted per-room only
+// (membership.jsSubjectsFor), so a peer can reach the API of its OWN rooms'
+// streams but not the control-plane KV buckets (KV_UNIBUS_*) nor another room's
+// stream. See TestAttack0008_N2 for the closed-leak regression.
 func TestReaudit_H4_WildcardMetadataLeak(t *testing.T) {
 	dir := t.TempDir()
 	store, err := membership.Open(filepath.Join(dir, "unibus.db"))