feat: add namespace-based multi-user isolation

Implement namespace support across sessions, machines, and users for multi-user server deployments. Add access control with specific error reasons (namespace-missing, access-denied, not-found) and database schema updates with namespace columns and indexes.

server/src/sse/sseManager.test.ts

@@ -0,0 +1,66 @@
+import { describe, expect, it } from 'bun:test'
+import { SSEManager } from './sseManager'
+import type { SyncEvent } from '../sync/syncEngine'
+
+describe('SSEManager namespace filtering', () => {
+    it('routes events to matching namespace', () => {
+        const manager = new SSEManager(0)
+        const receivedAlpha: SyncEvent[] = []
+        const receivedBeta: SyncEvent[] = []
+
+        manager.subscribe({
+            id: 'alpha',
+            namespace: 'alpha',
+            all: true,
+            send: (event) => {
+                receivedAlpha.push(event)
+            },
+            sendHeartbeat: () => {}
+        })
+
+        manager.subscribe({
+            id: 'beta',
+            namespace: 'beta',
+            all: true,
+            send: (event) => {
+                receivedBeta.push(event)
+            },
+            sendHeartbeat: () => {}
+        })
+
+        manager.broadcast({ type: 'session-updated', sessionId: 's1', namespace: 'alpha' })
+
+        expect(receivedAlpha).toHaveLength(1)
+        expect(receivedBeta).toHaveLength(0)
+    })
+
+    it('broadcasts connection-changed to all namespaces', () => {
+        const manager = new SSEManager(0)
+        const received: Array<{ id: string; event: SyncEvent }> = []
+
+        manager.subscribe({
+            id: 'alpha',
+            namespace: 'alpha',
+            all: true,
+            send: (event) => {
+                received.push({ id: 'alpha', event })
+            },
+            sendHeartbeat: () => {}
+        })
+
+        manager.subscribe({
+            id: 'beta',
+            namespace: 'beta',
+            all: true,
+            send: (event) => {
+                received.push({ id: 'beta', event })
+            },
+            sendHeartbeat: () => {}
+        })
+
+        manager.broadcast({ type: 'connection-changed', data: { status: 'connected' } })
+
+        expect(received).toHaveLength(2)
+        expect(received.map((entry) => entry.id).sort()).toEqual(['alpha', 'beta'])
+    })
+})