use HashSet;
/// Guards a single channel. Unauthorized messages are silently dropped.
///
/// Each channel gets its own `SecurityGate` instance built from that channel's
/// `allowed_users` list. Identity resolution (username → ID) happens outside this
/// struct, in the channel provider's `resolve_users()` call.