Camera permission and review fixes (openpanel C3, C4)

C4: a device's `viewers` (superusers by default, or members) covers the
image and video messages its ports publish. Anyone else gets none of their
values on the socket, in the catalogue or a flow's state, 403 for their
history, for the frames they hold (the last 8 included) and for TURN
credentials, no bytes when asking for them, and `bye: forbidden` for a live
view. A device credential stays bounded by its dashboards. The device page
sets it in its Camera section, and a tile the viewer may not see says
"No access to this camera" and asks the camera for nothing.

C3:
- A volatile upload is held to MAX_FRAME_BYTES (4 MiB, 413 above it, read
  without extra copies), and so is a frame on a device's socket.
- A frame the engine holds in memory is written to the ring directory
  before a local worker is handed it, so load_artifact finds it.
- A socket the bus dropped events for catches up with a snapshot, demand
  included, and a device's credential is checked again per frame, cached by
  the flow store revision and its nonce, so a lost event never keeps an
  unpaired device's frames coming.
- A report is at most 64 KB once its named config_schemas are put in place.
- A device away for 60 s has its true bool messages set to false.
- Refused frames are logged by fixed keys, a frame is named after its
  message, `fluksio serve` waits 5 s for open connections, a tile with a
  stream URL creates no demand, the 8-name cap keeps the newest names.
- Every container's log rotates (json-file, 3 x 10 MB).

docs/reference/configuration.md

@@ -169,14 +169,18 @@ MIG entries are passed on as written.
 | `ARTIFACT_GC_GRACE_S` | `3600` | minimum age before cleanup |
 | `ARTIFACT_VOLATILE_DIR` | auto-detected | where local workers write live frames, under `/dev/shm` or the temporary directory |
 | `ARTIFACT_VOLATILE_BYTES` | `50331648` (48 MiB) | live-media ring size, in the engine's memory and again in that directory; `0` stores volatile saves durably |
+| `MAX_FRAME_BYTES` | `4194304` (4 MiB) | the largest live frame: a volatile upload past it gets 413, a device's frame on its socket is dropped; keep it under 16 MiB, the websocket's limit |
 
 Cleanup removes durable artifacts no longer referenced by recorded runs or
 current messages, and pauses while a run is active. Volatile artifacts live in
 a bounded ring in the engine's memory, and the oldest disappear as it fills.
 Recorded run outputs are copied into durable storage. A worker in the engine's
 container writes its frames to `ARTIFACT_VOLATILE_DIR` instead, which the
-engine trims to the same size every few seconds. If workers publish frames
-under Docker, raise `shm_size` with the ring size.
+engine trims to the same size every few seconds. A frame the engine holds is
+written there too before a node in this container is handed it, so
+`load_artifact` finds it. If workers publish or read frames under Docker,
+raise `shm_size` with the ring size. The ring never holds more than its size
+plus one frame.
 
 ## Agents