[GHSA] GHSA-c7c5-5j6r-q957 (high) — djust has broken object-level access control (IDOR)

GHSA-c7c5-5j6r-q957 Severity: high CVE: CVE-2026-61596

djust has broken object-level access control (IDOR)

### Impact djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSocket **mount** and **event** paths but **not** on three other render entry points: (a) the initial **HTTP GET** render, (b) **SPA `url_change`** navigation, and (c) `{% liv