[iam] WS event feeds: org filtering for broadcast/user/TFactory, and a multi-org cockpit key (#312 follow-up) #3679

Follow-up from the #312 cockpit scoped-keys slice (plan/2026-11-07-312-cockpit-scoped-keys.md). Two gaps it leaves open:

1. /ws/events doesn't filter everything by org. In AIFactory, BroadcastScope/UserScope (websockets/event_bus.py:271-284) and PFactory's broadcast and user paths ignore client.org_ids. TFactory's feed has no org routing at all (websockets/events.py broadcast_event sends to every client). This applies to every principal, JWT sessions included. An acw_ key gets exactly what its owner's session gets, never more. Only OrgScope respects the key's org.
2. The cockpit covers one org per factory. Owned acw_ keys are bound to one org at mint (CreateApiKeyRequest.org_id is required). REST (project_authz.py:102,333) and now /ws/events confine a key to that org. CFactory holds one token per factory, so on a multi-org install the scoped cockpit sees one org. Options: a key per org in CFactory, or Phase 4 scoped service keys (docs/compliance/scoped-service-tokens.md) with read-only fleet scope.

Refs #312