Cross-account email disclosure via shared Redis listener

Information disclosure in Inbox Zero before 2.29.3 allows remote authenticated users to receive another account's cleaner thread events. The cleaner email stream endpoint reused a shared Redis subscription listener instead of isolating each server-sent event stream by account, so concurrent subscribers received events belonging to another account. Exposure requires two mutually untrusted authenticated accounts to use the early-access cleaner concurrently; self-hosted deployments are unaffected unless the disabled-by-default cleaner is enabled.