Rename to checkLinkPermissions and stop log following on revoke

The old name read as an unconditional unsubscribe. Log following has
its own subscription outside SubscriptionController, so check
core.log.follow on permission changes too. Move the per-connection
work into one helper and split the tests into userPermissionsUpdated
and rolesUpdated, checking the account update event is sent.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/controller/ControlConnection.test.js

@@ -189,6 +189,25 @@ describe("controller/src/ControlConnection", function() {
 			assert.equal(connection.logTransport, null);
 		});
 
+		it("stops following logs when the user loses permission", async function() {
+			await connection.handleLogSetSubscriptionsRequest(
+				new lib.LogSetSubscriptionsRequest(true, false, [], [])
+			);
+			connection.user = { checkPermission() { throw new lib.PermissionError("Permission denied"); } };
+			connection.checkLogPermission();
+			assert.equal(mockController.clusterLogger.transports.size, 0);
+			assert.equal(connection.logTransport, null);
+		});
+
+		it("keeps following logs when the user has permission", async function() {
+			await connection.handleLogSetSubscriptionsRequest(
+				new lib.LogSetSubscriptionsRequest(true, false, [], [])
+			);
+			connection.user = { checkPermission() {} };
+			connection.checkLogPermission();
+			assert.equal(mockController.clusterLogger.transports.size, 1);
+		});
+
 		it("removes the debug dump listener after repeated requests", async function() {
 			await connection.handleDebugDumpWsRequest(new lib.DebugDumpWsRequest());
 			await connection.handleDebugDumpWsRequest(new lib.DebugDumpWsRequest());