feat(v1.1.8): F3 realtime auth_mode = 'session' (migration 0033)

Migration 0033 widens topics.auth_mode CHECK to include 'session'
alongside 'public' and 'token'.

TopicAuthMode enum gains a Session variant (as_str + from_db
extended uniformly).

RealtimeAuthorityImpl now takes Arc<dyn UsersService> as a third
constructor arg. The Session branch of authorize_subscribe
delegates to UsersService::verify_session_for_realtime(app_id,
token):
  * Returns Some(user) → allow. The service bumps the sliding TTL
    on success.
  * Returns None → Unauthorized.
  * Defense-in-depth: even though verify_session_for_realtime
    already enforces cross-app isolation, the branch re-checks
    user.app_id == app_id.

Tests added (4 new cases): valid session token allows; missing
token is Unauthorized; wrong token is Unauthorized; cross-app
session token is Unauthorized. All 12 realtime_authority tests
pass.

Dashboard: TopicAuthMode TypeScript union widened to include
'session'; the topic create + edit forms gain a third radio option
labeled "session — requires a per-app user session minted by
users::login (v1.1.8)".

picloud binary: construction order reshuffled so users is built
before realtime_authority. app_secrets_repo is now .clone()'d into
the pubsub realtime wiring so the original Arc can be re-used by
realtime_authority.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

dashboard/src/routes/apps/[slug]/+page.svelte

@@ -1265,6 +1265,13 @@
 							<input type="radio" value="token" bind:group={createTopicAuthMode} />
 							<span><strong>token</strong> — requires a valid subscriber token</span>
 						</label>
+						<label class="radio-row">
+							<input type="radio" value="session" bind:group={createTopicAuthMode} />
+							<span>
+								<strong>session</strong> — requires a per-app user session
+								minted by <code>users::login</code> (v1.1.8)
+							</span>
+						</label>
 					</fieldset>
 				{/if}
 				{#if createTopicError}
@@ -1583,6 +1590,13 @@
 						<input type="radio" value="token" bind:group={editTopicAuthMode} />
 						<span><strong>token</strong> — requires a valid subscriber token</span>
 					</label>
+					<label class="radio-row">
+						<input type="radio" value="session" bind:group={editTopicAuthMode} />
+						<span>
+							<strong>session</strong> — requires a per-app user session minted
+							by <code>users::login</code> (v1.1.8)
+						</span>
+					</label>
 				</fieldset>
 			{/if}
 			{#if editFlipToExternal}