Authenticated, scoped sync: signed requests and per-path subscriptions

- RequestAuth: clients sign `${timestamp}:${path}:${body}` (as in
  sync-server-example); headers carry public key, timestamp, signature and
  algorithm. Pluggable signers/verifiers; Ed25519 via WebCrypto built in.
  Timestamp window and replay protection.
- KVStorageHttpServer requires auth ('none' must be explicit). With auth, every
  key, scan range and subscription path must be under the caller's public key.
- POST /events with { paths }: subscribers only receive (and on resume only
  replay) changes under their authorized paths.
- KVStorageHttp: signer option; subscribe(path)/unsubscribe(path)/close()
  replace watch(); 401/403 reject instead of retrying.
- KVStorageComposite: prefix option scopes sync, cache and subscription.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017Qxbkp4tA7G5SCWjzWuxmE

test/kv-storage/kv-storage-http-watch.test.ts

@@ -6,11 +6,11 @@ import { TestNetwork } from './sync-helpers.js'
 let network: TestNetwork
 afterEach(() => network?.close())
 
-describe('KVStorageHttp.watch (SSE)', () => {
+describe('KVStorageHttp.subscribe (SSE)', () => {
   it('receives changes made by other clients as remote change events', async () => {
     network = new TestNetwork()
     const watcher = network.client()
-    await watcher.watch()
+    await watcher.subscribe('')
     const received = watcher.waitFor('change', (e) => e.origin === 'remote')
     await network.client().child('users').set('1', { name: 'Ada', n: 1n })
     const event = await received
@@ -23,16 +23,16 @@ describe('KVStorageHttp.watch (SSE)', () => {
     network = new TestNetwork()
     const writer = network.client()
     const watcher = network.client()
-    await watcher.watch()
+    await watcher.subscribe('')
     const first = watcher.waitFor('change', (e) => e.origin === 'remote')
     await writer.writeMany([['a', 1]])
     await first
-    await watcher.unwatch()
+    await watcher.unsubscribe('')
     await writer.writeMany([['b', 2]])
     await writer.writeMany([['c', 3]])
     const replayed: KVChangeEvent[] = []
     watcher.on('change', (e) => replayed.push(e))
-    await watcher.watch() // resolves once caught up, so the missed changes have been emitted
+    await watcher.subscribe('') // resolves once caught up, so the missed changes have been emitted
     expect(replayed.map((e) => e.changes)).toEqual([[{ key: 'b', value: 2 }], [{ key: 'c', value: 3 }]])
   })
 
@@ -40,15 +40,15 @@ describe('KVStorageHttp.watch (SSE)', () => {
     network = new TestNetwork({ historySize: 1 })
     const writer = network.client()
     const watcher = network.client()
-    await watcher.watch()
+    await watcher.subscribe('')
     const seen = watcher.waitFor('change', () => true)
     await writer.writeMany([['a', 1]])
     await seen
-    await watcher.unwatch()
+    await watcher.unsubscribe('')
     await writer.writeMany([['b', 2]])
     await writer.writeMany([['c', 3]])
     const resync = watcher.waitFor('resync', () => true)
-    await watcher.watch()
+    await watcher.subscribe('')
     expect(await resync).toEqual({ id: expect.stringMatching(/-3$/) })
   })