Private-member disclosure via unchecked Subscribe

Missing authorization in Stoat before 0.15.0 allows remote authenticated users to read private-server member data via Subscribe. The Bonfire Subscribe handler adds any supplied server_id to the socket watch list without verifying membership, and event forwarding trusts that subscription when relaying UserUpdate events from the server's member-update topic. Any logged-in account, including one removed or banned from a server, can enumerate members and monitor later display-name, avatar, and status changes, but the published advisory ties this path only to UserUpdate events rather than messages or role data.