fix(webview): route webview:changed only to its owner in multi-user mode - #501

What

In multi-user mode, every connected SSE client received webview:changed, so any user saw the ids of other users' web-tab creates, edits and deletes. webview-routes.ts broadcast { action, id } with no owner, and the server's SSE routing hint has branches for tab:, the session prefixes, remote: and clipboard: but none for webview:, so the hint came back undefined and the event went to everyone.

How

• The three webview:changed broadcasts now carry owner: ownerLayoutKey(<record>.owner). The owner comes from the stored web-tab record, not from whoever made the request, so when an admin edits or deletes a user's tab, that user is notified.
• New src/web/webview-sse.ts (deriveWebviewSseHint, 6 lines) returns { username: owner, sessionScoped: true }, and server.ts routes webview: events through it, next to the existing tab: branch.
• Result: the owner plus admins receive the event; other users don't. A missing owner reaches admins only.
• Single-user delivery is unchanged. The payload gains owner: '@single', an optional field (non-breaking per docs/versioning-policy.md). webview-tabs.js only reads action and id before re-fetching, so it ignores it. The sse-events.ts doc comment lists the new field.

Testing

• test/webview-sse.test.ts (7) runs the real server hint function and the routes end to end. The multi-user isolation tests failed before the fix (bob received alice's create, update and delete). Removing the new webview: branch makes 4 of them fail; the 3 single-user tests pass either way, as they should.
• Existing suites pass unchanged, including webview-routes (27), tab-layout-sse (8) and sse-registry-parity (4).
• typecheck, lint, format:check and build are clean.