A panel writes only what its dashboards' inputs target

It still reads every message its dashboards show. A message a tile only
draws, or a setting is bound to, is no longer writable from the panel.

backend/fluksio/api/deps.py

@@ -99,14 +99,17 @@ def _locked(defn: DashboardDef, live: dict[str, Any]) -> bool:
 def _panel_writable(panel_id: str, request: Request) -> set[str]:
     """The messages this panel may publish to.
 
-    The same walk as the read allowlist, minus whatever a locked dashboard
-    contributes: ``locked`` is a dashboard saying it is there to be looked at,
-    and until this it stopped only the client drawing the control — the server
-    took the publish from a screen that asked anyway.
+    What its dashboards' inputs target, which is narrower than what it may
+    read: a chart, a reading or a bound setting is something a screen shows,
+    and showing a message does not entitle it to set one.
 
-    Not quite all of it: a querying chart publishes the request it reads by,
-    and a locked dashboard whose charts cannot ask goes blank rather than
-    read-only. That request is the exception ``panels.requests_of`` names.
+    A locked dashboard contributes less still: ``locked`` is a dashboard
+    saying it is there to be looked at, and until this it stopped only the
+    client drawing the control — the server took the publish from a screen
+    that asked anyway. Not nothing, though: a querying chart publishes the
+    request it reads by, and a locked dashboard whose charts cannot ask goes
+    blank rather than read-only. That request is the exception
+    ``panels.requests_of`` names.
 
     Union, exactly as the allowlist itself is: a message one dashboard on this
     panel displays and another controls stays writable, because the unlocked
@@ -131,9 +134,7 @@ def _panel_writable(panel_id: str, request: Request) -> set[str]:
     live = controller.state.get_present(bound) if bound and controller else {}
     for defn in defns:
         writable |= (
-            panels.requests_of(defn)
-            if _locked(defn, live)
-            else panels.messages_of(defn)
+            panels.requests_of(defn) if _locked(defn, live) else panels.targets_of(defn)
         )
     return writable
 
@@ -174,11 +175,12 @@ def _panel_may(payload: dict[str, Any], request: Request) -> None:
     Publishing is in the list because a panel cannot be strictly read-only — a
     control on a panel is the point of putting one there, and a querying chart
     asks for its window by publishing a request, which is why that request
-    counts as one of its widget's messages. Bounded to those, though: a screen
+    counts as one of its widget's targets. Bounded to those, though: a screen
     on a wall has no business reaching a message no tile on it draws, and the
-    catalogue behind ``GET /messages/`` is the whole namespace at once. A
-    dashboard that says it is locked is bounded further still — it entitles a
-    panel to read every message it names and to publish to none of them but
+    catalogue behind ``GET /messages/`` is the whole namespace at once. It
+    reads every message its tiles draw and writes only what its inputs target.
+    A dashboard that says it is locked is bounded further still — it entitles
+    a panel to read every message it names and to publish to none of them but
     the requests its own charts ask by.
 
     # ponytail: the panel file and the published dashboards are re-read per