feat: Client-published events + realtime presence

- POST /projects/:id/events accepts client-authored events restricted to
  the custom.* namespace — system types can't be spoofed. They flow
  through the same publishEvent fan-out: realtime, webhooks, and
  event_pattern functions all fire.
- Presence: subscribe/unsubscribe bumps a per-project count and
  broadcasts presence.update {online} to the realtime stream only —
  deliberately not through publishEvent so webhooks and "*" functions
  don't fire on connect noise. GET …/realtime/presence reads the count.
- @primora/client gains publish() and presence(); CLI gains events:send.

Verified live: presence 0->1 on subscribe, presence.update frame
delivered, custom event delivered to SSE + fired a custom.* function,
spoofed document.created rejected 400.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP.md

@@ -309,8 +309,14 @@ Channel subscriptions over the Phase 7 SSE stream, in `@primora/client`.
   with capped backoff, `onStateChange` lifecycle.
 - `channel("documents").on("created", cb)` — namespaces `document`, `object`,
   `issue`, `deploy`, `"*"` for everything; trailing `s` optional.
-- Presence and client-broadcast deliberately deferred — protocol question,
-  no consumer yet.
+- **Presence** ✅ — server tracks realtime subscribers per project;
+  `presence.update` {online: n} broadcasts on every join/leave (realtime-only,
+  never fans out to webhooks/functions), `GET …/realtime/presence` reads the
+  count, `client.presence()` wraps it.
+- **Client events** ✅ — `POST /projects/:id/events` publishes `custom.*`
+  types through the standard fan-out (realtime + webhooks + functions);
+  `client.publish("custom.x", data)` and `primora events:send` both reach it.
+  The `custom.*` prefix is enforced so clients can't spoof system events.
 
 ## Notifications — alert rules (unreleased)