feat: add namespace-based multi-user isolation

Implement namespace support across sessions, machines, and users for multi-user server deployments. Add access control with specific error reasons (namespace-missing, access-denied, not-found) and database schema updates with namespace columns and indexes.

cli/src/api/apiMachine.ts

@@ -192,6 +192,13 @@ export class ApiMachineClient {
                 this.machine.metadataVersion = obj.version
                 throw new Error('Metadata version mismatch')
             }
+
+            if (obj.result === 'error') {
+                const reason = typeof (obj as { reason?: unknown }).reason === 'string'
+                    ? (obj as { reason?: string }).reason
+                    : 'unknown'
+                throw new Error(`Machine metadata update failed (${reason})`)
+            }
         })
     }
 
@@ -241,6 +248,13 @@ export class ApiMachineClient {
                 this.machine.daemonStateVersion = obj.version
                 throw new Error('Daemon state version mismatch')
             }
+
+            if (obj.result === 'error') {
+                const reason = typeof (obj as { reason?: unknown }).reason === 'string'
+                    ? (obj as { reason?: string }).reason
+                    : 'unknown'
+                throw new Error(`Machine state update failed (${reason})`)
+            }
         })
     }
 
@@ -322,6 +336,10 @@ export class ApiMachineClient {
         this.socket.on('connect_error', (error) => {
             logger.debug(`[API MACHINE] Connection error: ${error.message}`)
         })
+
+        this.socket.on('error', (payload) => {
+            logger.debug('[API MACHINE] Socket error:', payload)
+        })
     }
 
     private startKeepAlive(): void {