allow non-admin publish to the subscribe request channel

[fabracht]

Closes #40.

Summary

• mqdb subscribe was blocked for non-admin users: $DB/_sub/subscribe (and the $DB/_sub/{id}/heartbeat/unsubscribe control topics it publishes) were treated as internal $DB/_* topics and rejected with internal entity access denied
• adds a WriteOnly protection tier (the counterpart to ReadOnly) and gates $DB/_sub/# with it: any authenticated user may publish subscribe requests (still subject to ACL, like a normal topic), but subscribing to $DB/_sub/# is denied for non-service clients so one user cannot snoop another's requests or response topics
• chosen over the issue's suggested "add _sub to the internal-entity allowlist" because that would also allow non-admin subscribe to the request channel (request snooping / response spoofing); the CLI only ever publishes there
• the server (internal service) bypasses topic protection and still consumes the requests; handle_subscribe has no separate admin gate

Test plan

• check_access_sub_channel_write_only — publish allowed, subscribe denied (incl. admin) for $DB/_sub/*
• provider tests: non-admin publishes to $DB/_sub/subscribe/heartbeat, non-admin cannot subscribe to $DB/_sub/#, internal service can consume
• E2E: a non-admin user ran mqdb subscribe, got a subscription (no denial), and received a change event on a create
• clippy clean, agent lib suite green