feat: open realtime tokens to chat members

The connection-token route is guarded by jz.bm.realtime-access instead
of presentations.realtime-owner: chat-group members get a token, and
when golem15.presentations is active so does everyone its owner guard
lets through (looked up by name among the activated plugins, no import).
Everyone else gets 401, 403 or 503 in the guard's error shape. The
realtime routes mount when golem15.chat or golem15.presentations is
active. /_chat, /_chatchannels and /_chatbots are reserved prefixes of
the student app.

plugin.go

@@ -12,6 +12,7 @@ import (
 	"git.golem15.com/golem15/summercms/modules/lighthouse/centrifugo"
 	"git.golem15.com/golem15/summercms/modules/pact"
 	"git.golem15.com/golem15/summercms/modules/party"
+	"git.golem15.com/jakub/sm-bm-plugin/classes"
 	"git.golem15.com/jakub/sm-bm-plugin/console"
 	"git.golem15.com/jakub/sm-bm-plugin/controllers"
 	"github.com/go-gormigrate/gormigrate/v2"
@@ -30,6 +31,7 @@ var (
 	_ pact.AdminAssets         = (*Plugin)(nil)
 	_ pact.HasPermissions      = (*Plugin)(nil)
 	_ pact.HasNavigation       = (*Plugin)(nil)
+	_ pact.HasMiddleware       = (*Plugin)(nil)
 )
 
 //go:embed config
@@ -54,6 +56,9 @@ type Plugin struct {
 	// realtime is the app's lighthouse service, built at Boot. Nil when
 	// Boot did not run, as in tests that build routes on a bare plugin.
 	realtime *lighthouse.Service
+	// chatMember is the chat-group check of the realtime access guard; nil
+	// means classes.IsChatMember. Tests inject their own.
+	chatMember classes.MemberFunc
 }
 
 func (p *Plugin) ID() string { return "jz.bm" }