feat: material managers get a realtime token

- jz.bm.realtime-access admits holders of jz.bm.access_materials
  (Assumption A5), so every editor can follow materials:{id}
- README documents the materials channel, event and authorizer

plugin.go

@@ -71,7 +71,9 @@ type Plugin struct {
 	// their own.
 	watchMaterial func(ctx context.Context, db *gorm.DB, userID, id uint) (bool, error)
 	// materialManager is the material-manager check of the realtime access
-	// guard; nil means api.ManagesMaterials. Tests inject their own.
+	// guard (Assumption A5: every possible editor gets a connection token
+	// for the materials heads-up); nil means api.ManagesMaterials. Tests
+	// inject their own.
 	materialManager func(ctx context.Context, db *gorm.DB, userID uint) (bool, error)
 	// materialIndex searches the materials index and keeps it current. Nil
 	// when Boot did not run: then search answers 503 and syncs are skipped.