serviceability: feed-scoped multicast subscription for EdgeSeat access passes

[martinsander00]

Goal

An EdgeSeat access-pass holder connects to everything they paid for with one command per machine, with seats billed per feed:

$ doublezero connect multicast --subscribe-feed shreds-nyc shreds-ams

Problem

The EdgeSeat feed gate only runs at connect time in create_user_core, and only for a single group. UpdateMulticastGroupRoles runs no feed gate and skips both multicast-group allowlists for EdgeSeat passes, so a second feed's groups are joinable for free and publishing is ungated. The client connect path fails with FeedAccountRequired, and CreateUser cannot create a bare multicast user under an EdgeSeat pass at all.

Design

Purchased and comped subscriptions become two separate paths:

• Purchased feeds: new SubscribeFeed / UnsubscribeFeed instructions. Gate: feed on the pass, serves the device's metro. One seat per feed.
• Comped groups: UpdateMulticastGroupRoles, allowlist-gated uniformly across pass types (the EdgeSeat bypass is deleted, which closes the publish gap by removal).

CreateUser becomes naked (no group, no feed) and idempotent, so connect can call it unconditionally: create, poll to Activated, then one atomic SubscribeFeed covering every feed and group.

Breakdown

1 must land before 2, or naked EdgeSeat users can join any group through an ungated UpdateMulticastGroupRoles.

1. onchain: SubscribeFeed / UnsubscribeFeed, delete the is_edge_seat guards (serviceability: add SubscribeFeed and UnsubscribeFeed for EdgeSeat feeds #4113)
2. onchain: naked and idempotent CreateUser (serviceability: make CreateUser naked and idempotent #4110)
3. sdk/client: connect multicast --subscribe-feed

Out of scope: CreateSubscribeUser and its --feed flag (#4087) stay as they are.

Supersedes #4097. PR #4099 (optional accounts retrofitted onto UpdateMulticastGroupRoles) was closed unmerged in favour of this design.