Product registry: catalogs, revisions, product info and libraries

The hub registers catalogs (hidden until a moderator approves them), hands out upload tokens, and records the
revisions catalogs register after validating uploads: numbered, never changed, signed by the hub (its own
Ed25519 key, published at /.well-known/t5de-keys.json). Creators edit product info (descriptions cleaned by an
allowlist) and can retract revisions. People get products into their library, optionally staying on a
revision; the proxy asks which revision to load and where. Contract in docs/products.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/api/src/realtime.ts

@@ -137,6 +137,11 @@ export class Realtime {
     if (changed) this.changed(chats);
   }
 
+  /** Sends a message to all of a person's connections. */
+  notify(userId: string, message: object) {
+    for (const s of this.sessions.values()) if (s.userId === userId) s.send(message);
+  }
+
   /** Closes a person's connections (banned, or signed out of their computers). */
   disconnect(userId: string) {
     for (const s of this.sessions.values()) if (s.userId === userId) s.close();