* display zone names consistently using friendly_name or raw id without transformation * enforce camera-level access on go2rtc live stream websocket endpoints