WebSocket subscribe is still authorization

WebSocket (and SSE) connections often authenticate once at the handshake, then treat every subscribe as free. That is authentication at the door, not authorization for each topic.

When a client sends subscribe: invoices:tenant-42, check that this subject may read that channel now—with the same object and tenant filters you use on REST. On revoke, drop the subscription; do not wait for reconnect. A live socket is not a blank cheque for every event stream.