The view: one read-only bus user for a page in a browser, composed like every other (hq research 036)

Research 036 names the gap (G1): no way for a browser to reach the bus. The bus module now listens
over WebSocket (mesh-catalog, nats); this is who connects there. The view is a fixed principal
(broker.KindView, user `view`) composed into the user list like every user once its credential is
minted, and left out once it is forgotten: it subscribes the issue tracker's events (opened, moved,
noted, linked), the controller's plan-moved and condition-raised/changed/cleared, and the delivery
owner's transition and group; it publishes only the JetStream API requests a read-only watcher of
the tracker's bucket (mesh-issues_issues) makes — STREAM.INFO, DIRECT.GET, CONSUMER.CREATE/INFO/
DELETE, flow control — answered in its own inbox; no reply, no tool, no event, no `$KV` write.

`bus view-credential` mints and prints it once (hash kept, like a person's); `bus view-revoke`
forgets it, real at the next composition. Tests: the composed grants are exactly these and a write
grant of any shape fails; the view is composed only once minted; and against a real server read from
the composed file over WebSocket, the view binds the bucket, reads a key, watches a put land, and is
refused a put, a delete and an event, the bucket unchanged.

internal/inventory/busrecords.go

@@ -108,6 +108,15 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 	for _, p := range people {
 		out.People[p.Name] = p.Invokes
 	}
+	// The view is composed once its credential is minted and until it is forgotten: its row is the
+	// record of it, nothing else being declared about it (broker.KindView).
+	kept, err := i.BusUsers(ctx)
+	if err != nil {
+		return broker.Records{}, err
+	}
+	if u, minted := kept[broker.ViewUser]; minted && u.Kind == BusView {
+		out.View = true
+	}
 	return out, nil
 }