Camera permission and review fixes (openpanel C3, C4)

C4: a device's `viewers` (superusers by default, or members) covers the
image and video messages its ports publish. Anyone else gets none of their
values on the socket, in the catalogue or a flow's state, 403 for their
history, for the frames they hold (the last 8 included) and for TURN
credentials, no bytes when asking for them, and `bye: forbidden` for a live
view. A device credential stays bounded by its dashboards. The device page
sets it in its Camera section, and a tile the viewer may not see says
"No access to this camera" and asks the camera for nothing.

C3:
- A volatile upload is held to MAX_FRAME_BYTES (4 MiB, 413 above it, read
  without extra copies), and so is a frame on a device's socket.
- A frame the engine holds in memory is written to the ring directory
  before a local worker is handed it, so load_artifact finds it.
- A socket the bus dropped events for catches up with a snapshot, demand
  included, and a device's credential is checked again per frame, cached by
  the flow store revision and its nonce, so a lost event never keeps an
  unpaired device's frames coming.
- A report is at most 64 KB once its named config_schemas are put in place.
- A device away for 60 s has its true bool messages set to false.
- Refused frames are logged by fixed keys, a frame is named after its
  message, `fluksio serve` waits 5 s for open connections, a tile with a
  stream URL creates no demand, the 8-name cap keeps the newest names.
- Every container's log rotates (json-file, 3 x 10 MB).

frontend/src/client/schemas.gen.ts

@@ -933,6 +933,11 @@ export const DeviceBindingSchema = {
             type: 'string',
             enum: ['in', 'out'],
             title: 'Direction'
+        },
+        dtype: {
+            type: 'string',
+            title: 'Dtype',
+            default: ''
         }
     },
     type: 'object',
@@ -976,6 +981,12 @@ export const DeviceDefSchema = {
             title: 'Touch',
             default: false
         },
+        viewers: {
+            type: 'string',
+            enum: ['superusers', 'members'],
+            title: 'Viewers',
+            default: 'superusers'
+        },
         version: {
             type: 'integer',
             title: 'Version',
@@ -1011,6 +1022,12 @@ export const DeviceDocumentSchema = {
             title: 'Touch',
             default: false
         },
+        viewers: {
+            type: 'string',
+            enum: ['superusers', 'members'],
+            title: 'Viewers',
+            default: 'superusers'
+        },
         version: {
             type: 'integer',
             title: 'Version',
@@ -1090,6 +1107,12 @@ export const DevicePublicSchema = {
             title: 'Touch',
             default: false
         },
+        viewers: {
+            type: 'string',
+            enum: ['superusers', 'members'],
+            title: 'Viewers',
+            default: 'superusers'
+        },
         version: {
             type: 'integer',
             title: 'Version',

frontend/src/client/sdk.gen.ts

@@ -271,7 +271,7 @@ export class ArtifactsService {
      * watching now, which the oldest of falls out of memory rather than being
      * kept. A worker on another host or a device publishing a camera sends this.
      * It is read into memory, where the ring holds it, and never touches the
-     * disk.
+     * disk, so it is held to ``MAX_FRAME_BYTES`` rather than the store's cap.
      * @param data The data for the request.
      * @param data.name
      * @param data.mediaType
@@ -1015,6 +1015,7 @@ export class DevicesService {
      *
      * STUN and TURN servers, the TURN ones with credentials of the caller's own
      * that expire. Empty when none are set, which is enough on one network.
+     * Only for whoever may see the device's camera (``DeviceDef.viewers``).
      * @param data The data for the request.
      * @param data.deviceId
      * @returns IceServers Successful Response
@@ -1958,6 +1959,9 @@ export class MessagesService {
     /**
      * Read Messages
      * Every message any published flow declares, with its last value.
+     *
+     * A camera the caller may not see is listed without its value, so a tile
+     * can still be bound to it.
      * @returns MessagesPublic Successful Response
      * @throws ApiError
      */

frontend/src/client/types.gen.ts

@@ -238,6 +238,7 @@ export type DeviceBinding = {
     port: string;
     message: string;
     direction: 'in' | 'out';
+    dtype?: string;
 };
 
 export type direction = 'in' | 'out';
@@ -254,9 +255,12 @@ export type DeviceDef = {
     title?: string;
     dashboards?: Array<(string)>;
     touch?: boolean;
+    viewers?: 'superusers' | 'members';
     version?: number;
 };
 
+export type viewers = 'superusers' | 'members';
+
 /**
  * A device as it reads itself: what it shows, and what its ports carry.
  *
@@ -268,6 +272,7 @@ export type DeviceDocument = {
     title?: string;
     dashboards?: Array<(string)>;
     touch?: boolean;
+    viewers?: 'superusers' | 'members';
     version?: number;
     io?: Array<DeviceIo>;
     bindings?: Array<DeviceBinding>;
@@ -293,6 +298,7 @@ export type DevicePublic = {
     title?: string;
     dashboards?: Array<(string)>;
     touch?: boolean;
+    viewers?: 'superusers' | 'members';
     version?: number;
     io?: Array<DeviceIo>;
     bindings?: Array<DeviceBinding>;