feat(client): union-read ReadCap gate + listMyEntityDocs + doc corrections

- read-model.ts `readUnion` now applies the emulated ReadCap gate (drops a
  subject when its doc is governsRead && !canRead for the current identity), so
  per-scope isolation holds by construction AND by filter.
- store-registry: `listMyEntityDocs(username, scope)` (current account only) vs
  the all-accounts `listEntityDocs` fallback (documented as the enumeration to
  avoid on the read path).
- docs: nextgraph-current-state / read-model — corrected to the SOURCE-VERIFIED
  reality that the JS SDK exposes NO open/sync-by-cap primitive
  (load_repo_from_read_cap is pub(crate)); in the mono-wallet all repos are
  already local (same session), so the anchorless union spans them with no open
  step. simulation.md: listEntityDocs+useShape({graphs}) is a fallback, not the
  read path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/simulation.md

@@ -69,8 +69,15 @@ public/protected/private stores — on top of one shared wallet.
   is its own document/repo with a future inbox) and appends its NURI to the
   account's **scope index document** — the index doc plays the role of the future
   **store-container** (it lists the entity-document NURIs "in" that scope).
-  `listEntityDocs(scope)` unions the contained NURIs across all accounts — the
-  read fan-out. Use the returned NURIs as `useShape(shape, { graphs })`.
+  `listEntityDocs(scope)` unions the contained NURIs across all accounts. This is a
+  **fallback / test-only** path, NOT the read path: enumerating every account and
+  handing the NURIs to `useShape({ graphs })` opens/syncs other accounts' possibly-
+  unsynced docs and HANGS (the ORM fan-out, ~75s — see
+  [`read-model.md`](./read-model.md)). The real READ path is
+  `readModel.readUnion(docs)` (open/sync by-need + ONE anchorless union
+  `sparql_query`); the app resolves the by-need doc set from the discovery index
+  (public events) and `listMyEntityDocs(username, scope)` (my own account, bounded —
+  no cross-account fan-out).
 - **GENERIC by construction.** The registry knows only the three native scopes,
   **zero** application entity kind. The consumer maps its entities to a scope and
   injects the session + username normalization via `configureStoreRegistry({