fix(hub): re-evaluate can_write on channel reattach

[jamofer]

What

Re-resolve the client write permission when a channel is reattached after an agent reconnect, instead of reusing the value stored at OPEN.

Why

Audit HUB-3 (HIGH), an ACL bypass introduced by the #149 reattach path. reattachClientsToAgent re-checked can_read but never can_write. So: client OPENs with a write grant → admin revokes write → agent flaps and re-registers → the channel reattaches with the stale can_write=true → the client keeps injecting frames. The AuthorizationPort revocation was silently defeated.

How

• Thread the freshly resolved can_write (via clientCanWrite) into ClientSession_ReattachInterface, assigning it onto the binding alongside interface_id/dormant — the reattach mutation stays atomic.
• broker.c computes it at the reattach site where peer/entry are already in scope.

Testing

• make test green (385/385, +1)
• New regression test in test_broker.cpp "client write authorization": grant write → OPEN → revoke write → agent flap → injected frame is dropped. Verified it fails without the fix.

Notes

Write-direction only (the security-critical stale-allow). Read is already re-checked on reattach. No wire-format impact.