DurableSubscriptionsSession.rehydrateUser should re-check hdb_user/hdb_role for non-_scopedToken sessions #3262

Summary

In server/mqtt/DurableSubscriptionsSession.ts (rehydrateUser, around line 491), a session whose this.user already has a role object and is not marked _scopedToken: true currently returns this.user directly without re-querying hdb_user / hdb_role unless this.user.username is looked up from storage.

When a session or will is bound to a User object that already has role populated in memory (including a Shape A server.getUser principal or an existing in-memory User), rehydrateUser() should verify that the backing hdb_user record is still active and refresh its role from hdb_user / hdb_role (or check isCurrentUser) before publishing a last-will message or restoring durable subscriptions.

Review-Deferral: a65a4c83934a960b severity=minor category=correctness