feat(auth): add read-only relay observer role

[100-eyes]

Summary

• add a directly provisioned observer relay role with exactly messages:read
• retain existing community and private-channel visibility filtering while denying event submission and every membership, media, Git, huddle, GIF, and workflow mutation path
• apply the same role-derived authority to WebSocket and HTTP transports
• re-read durable authorization before every WebSocket EVENT so a missed cross-pod disconnect cannot preserve stale write access after a downgrade
• restrict observer provisioning and role changes to the relay owner, publish observers in the NIP-43 membership snapshot, and expose operator CLI support
• add schema migration 0045, metrics coverage, protocol documentation, and production-seam regressions

Acceptance coverage

• open relays still honor a direct observer row instead of upgrading it to open-relay authority
• observer WS REQ and COUNT succeed
• observer HTTP query and count succeed
• observer WS and HTTP event submission fail at production authorization seams
• member-to-observer downgrade revokes the local live session and a simulated remote stale session still fails closed
• observer NIP-OA delegation is denied
• observer role round-trips through the NIP-43 snapshot and reconciliation detects drift

Validation

• just ci — passed, including Rust lint/unit suites, desktop and web checks/builds/tests, Flutter analysis, and 2,072 mobile tests
• focused Postgres production-seam tests for WS observer access/downgrade, HTTP read/write behavior, NIP-43 snapshot/reconciliation, and migration manifest — passed
• cargo fmt --all -- --check — passed
• git diff --check — passed

A full local just test also passed 15 named groups. Its two reported group failures both originate from the same pre-existing canonical-main source-policy test, observability_source::p0_pool_acquisitions_use_typed_operation_pairs_without_other, which rejects the unchanged crates/buzz-db/src/store/event.rs:270; this branch does not modify that file.

Closes #7462

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3c7f288c60d67df78577b237e27c3dfc8831aaa1...4b41887676a1bee52a189012114e16526d2bb1bd.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 4b41887676a1bee52a189012114e16526d2bb1bd to authorize a new review.
Any previous review applies only to its recorded range.