fix(acl): filter Server-object (i=2253) event subscriptions per event through the data-plane ACL (#586)

Server-object (all-events) items bypassed the ACL entirely: the SDK attached them to every root
notifier's fan-out via SubscribeToAllEvents, and a root notifier with no direct subscriber forwarded
to the core Server object, which this node manager never sees.

- SubscribeToAllEvents override records the item and attaches it to nothing.
- Each condition's own OnReportEvent (fires once per event) queues the event to each recorded item
  whose session holds Subscribe on the condition (RawPath) or any notifier folder it reports through
  -- the per-folder path's question; otherwise mirrors MonitoredNode2.OnReportEvent.
- The root-notifier forward to the core Server object (OnReportEvent override) is dropped.
- ConditionRefresh on an i=2253 item is filtered the same way (once per condition).
- Revalidation is implicit: every event re-asks the authorizer (per-generation cache, key expiry and
  revocation re-checked per call). Inert with Security:Acl:Enabled=false.

Over-the-wire tests: no-grant vs granted (positive control), created-before-deploy, revoke/restore by
deployment, key expiry with no tick, refresh, and flag-off. Falsified: disabling the filter, or
restoring the forward, turns the enforcement tests red.

Claude-Session: https://claude.ai/code/session_01Ef2ozxS7QPanGT8uoATbTe

docs/AlarmTracking.md

@@ -36,9 +36,12 @@ same condition is wired as an **event notifier of every referencing equipment fo
 `EnsureFolderIsEventNotifier(equipFolder)`.
 
 - A **single** `ReportEvent` fans through the SDK notifier graph to the raw device folder,
-  every referencing equipment folder, and up to the Server object. A subscriber at any one
+  every referencing equipment folder, and to the Server object. A subscriber at any one
   root receives **exactly one** copy of the transition — the Part 9 shared-`InstanceStateSnapshot`
   dedup (`MonitoredItem.QueueEvent` → `IsEventContainedInQueue`), **never** one copy per root.
+  The Server-object (`i=2253`) copy is delivered by the condition itself, not by the folders'
+  forward to the core Server object, so it can be filtered per subscriber by the data-plane ACL
+  (Gitea #586 — see `docs/security.md`).
   Duplicating the `ReportEvent` per root is rejected by design (distinct EventIds would break
   Server-object dedup + Part 9 ack correlation).
 - **Teardown is symmetric:** the node manager tracks the wired notifier pairs and calls