[Security] Scope realtime events for S3 operations to authorized users/rooms

[chromonav]

Branch reviewed: s3

Problem

Several realtime events are published without user/room scoping, which can leak operational metadata (file names, migration progress, cleanup outcomes) to unintended subscribers.

Evidence (file + line)

• aws_integration/aws_integration/s3/handlers.py#L158 (s3_upload_complete)
• aws_integration/aws_integration/s3/scheduler.py#L299 (s3_migration_progress)
• aws_integration/aws_integration/s3/scheduler.py#L306 (s3_migration_complete)
• aws_integration/aws_integration/s3/scheduler.py#L385 (s3_cleanup_progress)
• aws_integration/aws_integration/s3/scheduler.py#L398 (s3_cleanup_complete)
• aws_integration/aws_integration/s3/scheduler.py#L471 (s3_orphan_progress)
• aws_integration/aws_integration/s3/scheduler.py#L489 (s3_orphan_complete)

Risk / impact

• Cross-user visibility of internal maintenance operations.
• Potential disclosure of file identifiers and processing volume.
• Violates least-privilege notification patterns.

Replication suggestion

1. Open two Desk sessions with users of different roles.
2. Trigger upload/migration/cleanup with one privileged user.
3. Observe whether unrelated session receives realtime payloads/events.

Resolution suggestion

• Scope frappe.publish_realtime with explicit target (user, doctype+docname, or private room).
• Gate event publish paths behind permission-aware context.
• Avoid sending raw file identifiers unless strictly required by UI.

Acceptance criteria

• Realtime events are visible only to authorized session(s).
• Payload fields are minimized and non-sensitive.
• Permission regression test validates no cross-user leakage.