fix: warm ACL cache on live _changes miss (v1.7.0)

[PeterBaker0]

Summary

Fixes a race where continuous / live _changes filtering denied readable documents solely because the ACL row was not yet in the in-memory cache (missing-row-create-path). Continuous feeds never redeliver that seq, so the parent rec-* could stay invisible until a fresh sync.

On ACL cache miss during _changes filtering (and _all_docs / views / _find response filtering):

1. Warm via ensureDocRows / cache.ensureDocs
2. Authorize with normal resolveDocAcl (row + parent + dbacl)
3. Deny only after a successful warm shows the principal cannot read
4. Fail closed on ensure/view/AclUnavailableError
5. Skip _local/* ids in ensure (they are not ACL-mapped; warming them via keyed _all_docs + view reconcile incorrectly 503'd _local_docs)

Guest isolation and create-path / not-found semantics are unchanged.

API / version

• filterChangesStream now takes AclCache
• Added canReadEnsured
• Version 1.7.0 (CHANGELOG + README note that live _changes may await ACL warm)

Tests

• Unit: miss→warm→allow (normal / continuous / eventsource), miss→warm→deny, ensure throws fail-closed, batching, no ensure when already cached, _local skipped by ensureDocRows
• Integration: contributor with dbacl._r opens continuous feed before guest create; must see rec-* (+ child + rapid creates) on the live feed; stranger guest still isolated

Test plan

• pnpm lint / pnpm typecheck / pnpm test
• pnpm test:integration (docker stack) — 157 passed