CVE-2026-63116: deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

The RECORD_ACTION.PATCH_MULTI action is not registered in the Valve permission system’s RULES_MAP (src/services/permission/valve/rules-map.ts). When ConfigPermission.canPerformAction() is called for a PATCH_MULTI message, getRulesForMessage() returns null because the action is missing from the map. This triggers an unconditional allow (callback(..., null, true)), completely bypassing all configured Valve permission rules.

Any authenticated user — regardless of their configured permissions — can write arbitrary data to any record using the PATCH_MULTI action.