Design doc for a user-scoped capability-invalidation event on the
existing events WebSocket, so clients refresh cached capability
payloads (e.g. /downloads/capability) when admin permission or
server settings change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>