allowed_groups is documented as a channel access control but is never enforced

[andreolf]

Package channels store allowed_groups (server/src/tenant-package.ts, db/schema/core.ts) and the docs describe it as deciding which people a channel is open to, but no code reads the column (grep finds only tests). It is not currently exploitable, because synchronizeTenantPackage also writes no membership rows for package channels and every channel route gates on membership — so package channels are unreachable rather than open. The moment membership is wired up for package channels, a control the docs promise will silently not exist.

Fix: enforce allowed_groups at the channel-access check, or stop documenting it as an access control until it is.