fix(daemon): ungated raw sync surface + unauthenticated off-host bind

[cuttlefisch]

Two independent holes on the exact path a real multi-user hub runs on. Both block the deployment.

1. sync/resync and sync/diff had no access control

deny_kb_doc_read exists, is correct, and was called from two of the paths that need it — sync/state_vector and sync/full_state. Its own doc comment says KB content "must be fetched via the access-gated kb/node_fetch". sync/resync returns the same bytes under a different method name and sync/diff returns them as a delta, so that sentence was false.

sync/resync is the worse of the two: it also subscribe_docs the session. An ungated call granted a standing feed of every future edit, not one read.

With N authorized users on one hub, any of them could read — and keep receiving — every other user's KB node state, while kb/node_fetch on the same node correctly refused.

Both now gate through deny_kb_doc_read, which only denies kb:/kbc: docs, so plain file collaboration is untouched. sync/resync is checked twice — on the raw name and on the suffix-resolved one, because resolution can map a bare filename onto a kb: doc, and a single check on the raw name would be bypassable by asking for the other spelling.

2. A non-loopback bind with auth.mode != "key" is now a config error

The default is "none", and an unauthenticated session reaches kb_access_with_coll with principal == None, which returns Allow. So --bind 0.0.0.0 on a stock config granted Manage on every KB to every host that could reach the port — while doctor printed "collab config: OK". psk is plaintext on the wire and no better off-host.

Raised as an error, not a warning: a warning gets read past, and the shipped assets/daemon-config.toml has no [collab.auth] block at all while DAEMON_ADMIN.md tells operators to start from it.

Gates

raw_sync_methods_cannot_read_a_node_belonging_to_another_kb — Mallory owns kb-a (deliberately the highest role: if an owner of one KB cannot reach another's node, no lesser role can) and asks for kb-b's node via both methods.

Verified failing first:

sync/resync returned kb-b's node to an outsider:
  {"doc":"kb:concept:b-secret","state":"AAA=","sv":"AA=="}

The load-bearing assertion is the subscription count, not the error. A refusal that still subscribed would satisfy an error-only check and keep leaking every subsequent edit — which is the failure mode this file's header already calls out for kb/node_fetch.

an_unauthenticated_off_host_bind_is_refused across five bind/mode pairs, with loopback_and_key_mode_are_accepted as the control so the check cannot be satisfied by a function that rejects everything, plus a disabled-listener case.

Still open on the hub path

Not in this PR, from the same audit: docs/list/docs/content/docs/delete/kb/unregister/kb/list are still ungated (docs/list needs filtering rather than refusal — it feeds the editor's join-document picker); there is no server-side KB approval, so an operator cannot onboard user #2; and signed membership/content verification is inert on the hub because the anchor is only set by the P2P dialer.

Verification

• cd daemon && cargo test — 404 pass
• cargo clippy --all-targets -- -D warnings — clean