A system listener (iam_account_id null) used to match every object,
including account-owned ones - so it could see every account's data,
not just system-level (no-account) objects. And a listener owned by
the platform-owner account was treated the same as a system listener,
also seeing everything.

New rule: an account listener only matches an object with the SAME
iam_account_id; a system listener only matches an object with NO
iam_account_id at all. The two never cross - there is no longer any
listener that receives every account's events.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>