fix(multiuser): redact other users' current-item identifiers from queue status events

[lstein]

Summary

QueueItemStatusChangedEvent embeds a SessionQueueStatus that includes the
currently-running item's item_id, session_id, and batch_id. The full event
ships to user:{owner} and admin rooms. When user A's item changed status while
user B's item was the one in progress, owner A's frontend received the event with
B's identifiers exposed in the embedded queue_status.

This was identified as out-of-scope in the security audit on #127.

Fix

In _set_queue_item_status, after building queue_status, scrub item_id /
session_id / batch_id when the in-progress item belongs to a different user
than the changed item. Aggregate counts stay global (not user-sensitive). The
frontend never reads those fields off the event payload (only batch_status.batch_id,
which is the changed item's own batch — no leak), so no UI behavior changes.

Test plan

• New regression test test_event_redacts_other_users_current_item_identifiers
  verifies that when user B's item is in_progress and user A's item is canceled,
  A's emitted event has queue_status.item_id/session_id/batch_id == None.
• test_event_preserves_owner_current_item_identifiers confirms no over-redaction
  when there's no in-progress item.
• test_event_preserves_identifiers_when_current_item_is_the_changed_item confirms
  identifiers ARE exposed when the in-progress item is the changed item itself.
• Verified the regression test fails without the fix and passes with it.
• All 16 session-queue + sanitization tests pass.

🤖 Generated with Claude Code