Add the operator console's live telemetry socket

The only socket until now was the gateway-facing /ws/edge/v1, which
authenticates as a *farm* with a credential any of its gateways holds,
and which accepts telemetry. Pointing a browser at it would mean handing
the browser something that can drive printers. /ws/telemetry
authenticates as a *user* with a Supabase access token, and accepts
nothing at all: it is push-only, and a frame arriving from the browser is
ignored. Everything that changes a printer keeps going over HTTP, where
the role checks and the audit trail already are.

Auth is checked at the upgrade, as on the edge socket, so an
unauthenticated browser never gets a socket. The token rides in
`Sec-WebSocket-Protocol` - `new WebSocket(url, ["bearer", token])` -
because that field is the whole of what JavaScript controls about a
browser handshake, and the usual workaround of `?token=` would put a
bearer credential into every access and proxy log. "bearer" is first
because the runtime echoes the *first* offered value back in the
response header, so the token must not be in that position; asserted,
not assumed.

The payload is the printer resource itself, returned straight out of
`persistTelemetry`'s UPDATE through `printerProjection` - the same
projection the REST routes use. So a push is byte-for-byte what
`GET /printers/:id` would have answered, and a client applies it to the
row it already holds. Rebuilding it from the gateway's snapshot instead
would be a second translation of the same data, free to drift, and
missing the columns a gateway never reports at all like `name` and
`vendor`.

`maySee` is what keeps one organisation's telemetry out of another's
console, and it lives in `telemetry/broadcast.ts` with no imports but a
type so it can be tested without a socket or a database - the same reason
as `dispatch/job_status.ts`, `stream.ts` and `auth/edge_upgrade.ts`. It
refuses a printer with no farm rather than matching it against anything,
which no row can be today, because this is the one function where being
wrong leaks another org's machines.

**A latent bug this turned up:** the edge route's resolve was
`{ as: "scoped" }`, copied from `requireUser`. For `requireUser` that is
right - it is used inside each route file and must propagate `user` to
that file's routes. On a ws plugin it propagates the check to the parent
app, where it gates every route mounted *after* that plugin. Measured
with a two-plugin probe: the second plugin's own socket is refused
because the first one's check runs first and finds no edge token. Nothing
shipped broken only because /ws/telemetry is the first route mounted
after it - and it was refused outright until this was found. Both ws
resolves now use the default `local` scope.

Known limits, both written down rather than discovered later:

- **In-process fan-out.** A `Set` of callbacks in one process, so two
  backend instances would each push only the telemetry their own
  gateways are connected to and an operator would see half a fleet. The
  fix is Valkey pub/sub, already a dependency; doing it now would mean
  testing a message broker to deliver events between two objects in the
  same process.
- **Visibility is resolved once, when the socket opens.** Re-deriving it
  per message would put a database round trip on every push to every
  viewer. The direction that matters: someone removed from an
  organisation keeps receiving its telemetry until their socket drops.
  Closing that needs a signal on membership change that this backend does
  not have; a periodic re-resolve would narrow the window without closing
  it. Telemetry is also the least sensitive thing here, and every HTTP
  route re-checks on each request.

Verified against the real stack, not just mirrored in unit tests:
`scripts/e2e-edge.sh` now drives the actual route with a real
JWKS-verified token and asserts the handshake echoes "bearer", that a
`ready` frame arrives, and that a real push carries the printer resource
with live readings - "2 push(es); last was H2C state=FINISH nozzle=30
camera=h2c". A bogus token is refused before any socket exists.
`scripts/watch-telemetry.ts` is the client it uses, and is the quickest
way to see by hand whether a farm's telemetry reaches a console.

110 tests (was 95), `bunx tsc --noEmit` clean.

scripts/e2e-edge.sh

@@ -335,6 +335,50 @@ if [ -n "$NO_CAMERA" ]; then
   ok "a printer with no camera is refused with 404, blaming the right half"
 fi
 
+# --- 5c. the operator console's live feed ----------------------------------
+
+# The user-facing socket, driven for real. The unit tests can only mirror its
+# composition, because the route imports ../../db; this is the only thing that
+# proves it is wired into the app at all, that the Supabase token verifies on
+# the upgrade, and that a gateway's telemetry actually reaches a console.
+echo "==> /ws/telemetry: connecting as the operator and waiting for a push"
+WS_OUT="$WORK/telemetry.json"
+if bun scripts/watch-telemetry.ts "ws://localhost:$PORT" "$USER_TOKEN" 12 > "$WS_OUT" 2>"$WORK/ws.err"; then
+  python3 - "$WS_OUT" <<'PYCHK' || fail "the telemetry socket did not behave: $(cat "$WS_OUT" "$WORK/ws.err")"
+import json, sys
+d = json.load(open(sys.argv[1]))
+# "bearer" and not the token: the runtime echoes the first offered subprotocol
+# back in the response header, so the credential must not be in that position.
+assert d["negotiated"] == "bearer", f'echoed subprotocol was {d["negotiated"]!r}, expected "bearer"'
+kinds = [f.get("type") for f in d["frames"]]
+assert "ready" in kinds, f"no ready frame; got {kinds}"
+ready = next(f for f in d["frames"] if f.get("type") == "ready")
+assert ready["visiblePrinters"] >= 1, f"ready says {ready['visiblePrinters']} visible printers"
+pushes = [f for f in d["frames"] if f.get("type") == "printer.telemetry"]
+assert pushes, f"no printer.telemetry push arrived; got {kinds}"
+# A push must be the printer resource, not a telemetry-shaped subset, and must
+# carry real readings rather than a touched row of nulls.
+p = pushes[-1]["printer"]
+for key in ("id", "farmId", "name", "vendor"):
+    assert key in p, f"push is missing {key}: {p}"
+assert p.get("vendorState"), f"push carries no vendor state: {p}"
+print(f'  ok: {len(pushes)} push(es); last was {p["name"]} '
+      f'state={p["vendorState"]} nozzle={p.get("nozzleTempC")} camera={p.get("cameraStream")}')
+PYCHK
+else
+  fail "could not connect to /ws/telemetry: $(cat "$WORK/ws.err")"
+fi
+ok "the console socket authenticated and received live telemetry"
+
+# A socket with no valid credential must not open at all - the whole point of
+# checking at the upgrade rather than in a first message.
+echo "==> an unauthenticated console socket must be refused"
+if bun scripts/watch-telemetry.ts "ws://localhost:$PORT" "not-a-real-token" 5 \
+     > "$WORK/ws-bad.json" 2>&1; then
+  fail "a socket opened with a bogus token: $(cat "$WORK/ws-bad.json")"
+fi
+ok "a bogus token is refused before any socket exists"
+
 # --- 6. the negative case --------------------------------------------------
 
 echo "==> an unclaimed printer must be refused, not guessed at"

scripts/watch-telemetry.ts

@@ -0,0 +1,38 @@
+/**
+ * Connects to /ws/telemetry as a user and prints what arrives, then exits.
+ *
+ * Exists for scripts/e2e-edge.sh, which can then assert on real frames from
+ * the real route rather than on a mirrored composition in a unit test. Also
+ * useful by hand: it is the quickest way to see whether a farm's telemetry is
+ * actually reaching a console.
+ *
+ * Usage: bun scripts/watch-telemetry.ts <ws-base> <access-token> [seconds]
+ */
+const [base, token, secondsArg] = process.argv.slice(2);
+if (!base || !token) {
+  console.error("usage: watch-telemetry.ts <ws-base> <access-token> [seconds]");
+  process.exit(2);
+}
+const seconds = Number(secondsArg ?? 15);
+
+// The token goes in the subprotocol, not the URL - a browser cannot set
+// headers, and a query parameter would put a bearer credential in every
+// access log. "bearer" first: the server echoes the first offered value back,
+// and the token must not be what comes back.
+const ws = new WebSocket(`${base}/ws/telemetry`, ["bearer", token]);
+
+const frames: unknown[] = [];
+ws.onmessage = (event) => {
+  frames.push(typeof event.data === "string" ? JSON.parse(event.data) : event.data);
+};
+ws.onerror = () => {
+  console.error("REFUSED: the socket would not open");
+  process.exit(1);
+};
+
+setTimeout(() => {
+  // Printed as one JSON document so the caller can parse it rather than
+  // scraping log lines.
+  console.log(JSON.stringify({ negotiated: ws.protocol, frames }, null, 2));
+  process.exit(0);
+}, seconds * 1000);