feat(client): read filter — capability-based view over the reactive set

makeReadFilteredView wraps a DeepSignalSet in a Proxy whose iteration/size/forEach
yield only items the current user may read (canRead on the item's emulated grant), while
add/delete and the underlying reactivity pass through. filterReadable is the pure core.
useShape applies it only when a grantOf resolver is configured (else passthrough, so
ungranted apps are unaffected). grantOf/setGrantOf added to the polyfill surface. Mirrors
the broker delivering only authorized docs; removed at migration. 4 unit tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/src/polyfill.ts

@@ -9,6 +9,7 @@
  */
 
 import type { NgLike, UseShapeLike, PrincipalId } from "./types";
+import type { GrantResolver } from "./read-filter";
 
 export interface EventuallyConfig {
   /** The REAL `@ng-org/web` `ng` (injected to avoid a hard import / alias loop). */
@@ -23,14 +24,18 @@ export interface EventuallyConfig {
   init?: (...args: any[]) => any;
   /** REAL `@ng-org/orm` `initNg` (ORM signals) — forwarded by the lib's `initNg()`. */
   initNg?: (...args: any[]) => any;
+  /** How to read a document's emulated grant. When set, reads are filtered. */
+  grantOf?: GrantResolver;
 }
 
 let cfg: EventuallyConfig | null = null;
 let currentUser: PrincipalId | null = null;
+let grantOf: GrantResolver | null = null;
 
 export function configure(c: EventuallyConfig): void {
   cfg = c;
   currentUser = c.currentUser ?? null;
+  grantOf = c.grantOf ?? null;
 }
 
 /** @internal — used by the SDK-shaped wrappers to reach the injected real SDK. */
@@ -48,6 +53,16 @@ export function getCurrentUser(): PrincipalId | null {
   return currentUser;
 }
 
+/** Set/clear how reads resolve a document's grant. null → reads pass through. */
+export function setGrantOf(fn: GrantResolver | null): void {
+  grantOf = fn;
+}
+
+export function getGrantOf(): GrantResolver | null {
+  return grantOf;
+}
+
 // Capability helpers — polyfill-era surface (caps are emulated now; native at
 // migration). Re-exported here so the whole polyfill API lives under /polyfill.
 export { canRead, canWrite, defaultGrant, grantRead } from "./access";
+export type { GrantResolver } from "./read-filter";