v2.15.0

• feat: the Directory and Discovery Plugins views update themselves. A resource added, renamed or removed by another admin (or by a discovery plugin run) now appears without a refresh. The Directory table is derived — hierarchy from the edge list, hostName from the parent, agent status from another service, indentation and carets recomputed by renderTable() — so a change re-derives the view rather than patching one row, which would leave a new child at the wrong depth with no caret on its parent. loadResources() re-reads the search, sort and secrets-only controls, so the operator's filter survives. Debounced, since one edit emits several events and an import emits a burst.
• fix: the socket never connected at all. authIO called Auth.checkToken(tok) with a bare string where {token} is expected, then called token.getUser() — but checkToken returns the User itself and has no such method. Every handshake failed with token.getUser is not a function, so no client in this app has ever had a working socket.
• fix: nothing published. @simpleworkjs/orm has a pubsub hook that emits model:<Name>:<action> on save/delete, and it was never wired. It is now, through utils/socket_pubsub.ormBus — a filter that forwards only models with a socket read gate. The ORM publishes for everything it loads, including AuthToken, OtpToken and PasswordResetToken, written on every login and password reset; those must never reach a browser and would be constant bus churn besides.
• security: READERS is the single source of truth for what goes live. A model listed there both publishes (LIVE_MODELS is derived from it) and is authorized there, so the two cannot drift — publishing something ungated would leak, gating something that never publishes would be dead code. Resource, ResourceGroup and PluginInstance are gated to the same admin groups that guard their REST routes, resolved transitively from LDAP as utils/permission.byGroup does and cached briefly per socket.
• note: views/plugins.ejs is dead code — /plugins redirects to /directory and that UI was ported into directory.ejs. The Discovery Plugins subscription lives with the code that actually runs.