Suspending an account ends everything it has open #834

Closes #757

When the owner suspends or removes an account, what it already has open ends then, not when it would close by itself:

• Event streams. Each live stream (/events, a repository's stream, a job's tail) is noted under the signed-in account that opened it, and closes when that account is suspended or removed (src/http/caller.ts, src/http/sse.ts).
• App sockets. A proxied websocket remembers the person its grant named and closes (1008) on their suspension. Other visitors' sockets and the app itself go on. A grant naming a suspended or removed person no longer vouches for anyone, whether the app is public or private (src/apps/proxy.ts).
• A push under way. The pre-receive hook asks for the pusher's standing again at the ref update. A push whose account was suspended after it was authenticated does not land, over HTTP or SSH (src/http/server.ts). SSH sessions already ended on suspension (#682); this covers the window between the pack arriving and the refs moving.

Tests (they fail without the change):

• test/accounts.test.ts: an open stream ends on its account's suspension; another account's stream stays open; a pre-receive from a suspended pusher is refused.
• test/apps-ws.test.ts: a visitor's socket closes with 1008 on suspension; a stranger's socket on the same app keeps talking; the old grant no longer names the person.

🤖 Generated with Claude Code