Expose a subscribable event stream for keypair/vfolder state changes to trusted satellite services

## Problem

Revocation-relevant changes — keypair deactivation, secret rotation, vfolder unshare, vfolder trash/status change, host-permission change — reach a satellite gateway **only via cache TTL expiry** today. BAIFS keeps these tight (secrets ≤ 300 s, authz ≤ 30 s, both configurable; commit-point operations re-check fresh), which is already ~two orders of magnitude tighter than the incumbent Storage Proxy's 1 h–24 h irrevocable JWTs — but it is still **polling**, so there is an inherent lag bound.

## Request

A subscribable **event stream** on the Manager's event bus, reachable by trusted satellite services, carrying at least:

- keypair state changes (deactivation, secret rotation),
- vfolder permission/share changes,
- vfolder status changes (trash/delete lifecycle).

Push notifications would let BAIFS invalidate caches immediately and keep TTLs only as a fallback, tightening revocation latency toward real-time without shrinking TTLs to zero (which would hammer the Manager).

## Rationale

- Turns a polling lag bound into event-driven invalidation for security-relevant state.
- Non-blocking for v1 (TTLs are an acceptable floor), but it is the natural path to sub-second revocation and reduces steady-state Manager query load.
- Generic to any satellite service maintaining Manager-derived caches.

## Citations (`6d680960d`)

- Cache-TTL staleness bounds and commit-point re-checks: [docs/02 §4.4](../../02-authentication.md).
- Incumbent Storage-Proxy JWT validity (`1 h`/`24 h`, no revocation): `storage/config/unified.py:612-627` (referenced in [docs/07 Q7](../../07-risks-open-questions.md)).

---
_Filed from the BAIFS project: see lablup/BAIFS#6 and `docs/spikes/upstream-asks/03-change-event-stream.md` for full context and citations._

Start with the cited authentication notes in docs/02-authentication.md and the BAIFS context in docs/spikes/upstream-asks/03-change-event-stream.md. The issue does not name a Manager event-bus entry point or tests, so first locate those before estimating implementation scope. Done means trusted satellite services can subscribe to events covering the listed keypair and vfolder state changes.

Written by the indexing model from the issue text.