feat: announce material revisions on materials:{id}

- every revision bump (API writes and /bmadmin saves) enqueues
  updated.jz.bm.material with {material_id, revision} in a savepoint
- the materials namespace authorizer allows a subscribe only to a
  visible material the user may manage
- api.ManagesMaterials and api.CanWatchMaterial

plugin.go

@@ -66,6 +66,13 @@ type Plugin struct {
 	// chatMember is the chat-group check of the realtime access guard; nil
 	// means classes.IsChatMember. Tests inject their own.
 	chatMember classes.MemberFunc
+	// watchMaterial is the materials channel check of the realtime
+	// authorizer; nil means api.CanWatchMaterial at time.Now. Tests inject
+	// their own.
+	watchMaterial func(ctx context.Context, db *gorm.DB, userID, id uint) (bool, error)
+	// materialManager is the material-manager check of the realtime access
+	// guard; nil means api.ManagesMaterials. Tests inject their own.
+	materialManager func(ctx context.Context, db *gorm.DB, userID uint) (bool, error)
 	// materialIndex searches the materials index and keeps it current. Nil
 	// when Boot did not run: then search answers 503 and syncs are skipped.
 	materialIndex *classes.MaterialIndexer