Camera permission and review fixes (openpanel C3, C4)

C4: a device's `viewers` (superusers by default, or members) covers the
image and video messages its ports publish. Anyone else gets none of their
values on the socket, in the catalogue or a flow's state, 403 for their
history, for the frames they hold (the last 8 included) and for TURN
credentials, no bytes when asking for them, and `bye: forbidden` for a live
view. A device credential stays bounded by its dashboards. The device page
sets it in its Camera section, and a tile the viewer may not see says
"No access to this camera" and asks the camera for nothing.

C3:
- A volatile upload is held to MAX_FRAME_BYTES (4 MiB, 413 above it, read
  without extra copies), and so is a frame on a device's socket.
- A frame the engine holds in memory is written to the ring directory
  before a local worker is handed it, so load_artifact finds it.
- A socket the bus dropped events for catches up with a snapshot, demand
  included, and a device's credential is checked again per frame, cached by
  the flow store revision and its nonce, so a lost event never keeps an
  unpaired device's frames coming.
- A report is at most 64 KB once its named config_schemas are put in place.
- A device away for 60 s has its true bool messages set to false.
- Refused frames are logged by fixed keys, a frame is named after its
  message, `fluksio serve` waits 5 s for open connections, a tile with a
  stream URL creates no demand, the 8-name cap keeps the newest names.
- Every container's log rotates (json-file, 3 x 10 MB).

docs/interface/dashboards.md

@@ -552,12 +552,20 @@ lights up on the canvas. `out` messages are read only. The node is shown
 degraded, *Offline*, in amber while the device is not connected: a warning on
 Home, not a fault, since a panel switched off or asleep breaks nothing.
 
+A `bool` the device publishes, such as a camera's `person`, says something is
+so right now, and a device that went away cannot say it no longer is. Once the
+device has been away for 60 seconds, the same wait as before its node shows
+*Offline*, each of its `bool` messages that reads true is set to false by its
+device node. A device back within that wait keeps its values, so a restart of
+either side changes nothing. Its other values keep the last one it sent.
+
 ### What a device reports
 
 A paired device says what it has with `PUT /devices/{id}/report`, from its own
 credential only. openpanel sends it after pairing and once per boot. The report
-replaces the one before and is at most 16 KB. It is read leniently, so a newer
-firmware still reports to an older instance:
+replaces the one before and is at most 16 KB, and 64 KB as kept, once named
+`config_schemas` are put in place. It is read leniently, so a newer firmware
+still reports to an older instance:
 
 - keys this version does not know are dropped
 - a value it does not know for a display `shape` or a port `direction` reads as
@@ -635,6 +643,29 @@ A device may fetch the last 8 artifacts each of its messages pointed at, not
 only the current one, so a screen fetching a camera frame by frame through the
 portal is not refused a frame the camera has just replaced.
 
+#### Who may watch a camera
+
+**Who may watch** in the Camera section of the device's page decides who sees
+what its camera sends, its `image` and `video` messages: **Superusers**, the
+default, or **All members**. A member of the portal is a member here. For
+anyone it leaves out:
+
+- the messages' values are left out of the live socket, `GET /messages/` and a
+  flow's state, and their history answers 403
+- the frames those messages hold, the last 8 included, answer 403, and a
+  socket asking for their bytes gets none
+- a live view is refused with `forbidden`, and so are TURN credentials
+- a dashboard tile or the device's preview says *No access to this camera*
+
+A wall panel shows the camera when one of its dashboards carries it, whoever
+watches the wall: a superuser assigned it the dashboards.
+
+The setting covers the camera's own messages, not what a flow makes of them.
+Anyone who edits flows can wire a node that passes a picture on under another
+name, and node code reads whatever it is handed. How long a kept `snapshot`
+stays and a light on the device that shows the camera is on are not part of
+it yet.
+
 #### Live view
 
 A media tile showing a device's `camera`, and the preview on the device's