Forward an already-verified WebSocket upgrade Request to a tenant's hub. The
caller (stream-router.ts) has rewritten it to /subscribe with the ticket's
actorId/role as query params; this only routes it to idFromName(tenantId).
Forward one approval stream event to its tenant's hub, POSTing it to the
hub's /internal/event route. Routed by event.record.tenantId, which the
hub re-asserts against its own id.name (defense in depth).
Forward an already-verified WebSocket upgrade Request to a tenant's hub. The caller (stream-router.ts) has rewritten it to
/subscribewith the ticket's actorId/role as query params; this only routes it to idFromName(tenantId).