feat(relay): verify NIP-FI agent tokens and admit agents through owners (#8401)

The relay side of NIP-FI agent tokens. An agent token has its own type,
`nip-fi-agent+jwt`, and carries its human owner's pubkey in
`nostr_owner_pubkey`. This PR verifies that claim, makes denying or
disconnecting the owner cut off every agent that owner authorized, and
makes the verified owner decide community admission. A relay without
agent support refuses the unknown type, so nothing needs to advertise or
configure agent support. The `NIP-FI.md` text for the agent type is
included.

Builds on #8372 and #8377 (both merged).

### Owner claim and owner deny

- **Token type binds the owner claim (`buzz-auth`).** A `DedicatedNipFi`
issuer policy accepts `nip-fi+jwt` (human) and `nip-fi-agent+jwt`
(agent); `AccessTokenAtJwt` policies stay `at+jwt`-only with their
`client_id` and subject rules unchanged, and unknown types are refused.
An agent token must carry a lowercase-hex `nostr_owner_pubkey` distinct
from its `nostr_pubkey`; a human or `at+jwt` token carrying the claim
with any value, including null, is `evidence_rejected`. The verified
owner is exposed as `VerifiedAssertion::owner()`.
- **No agent switch.** There is no relay setting, NIP-11 field or
operator binding field for agent support.
- **Session owner.** Each connection records its NIP-FI issuer and the
agent's owner (`NipFiSession`) on the root WebSocket manager and the
audio registry. `disconnect_nip_fi(iss, target)` closes a connection
when either its own key or its recorded owner equals the target.
- **Owner deny check.** `nip_fi_core::assertion_denied` checks the deny
set for both `(iss, k)` and `(iss, owner)`, and every existing deny
check uses it: WebSocket before upgrade and after registration, HTTP,
audio, and the shadow observer, so shadow and enforce make the same
decisions. The shadow disconnect observer matches a session's key or
owner under its issuer with the same rule, so an owner's disconnect
records a would-close for its agents.

### Shadow owner check

In shadow mode, WebSocket AUTH, audio join and HTTP admission record a
`Stage::Owner` verdict when an admitted agent token's owner is banned
(`owner/denied`), conflicts with the agent's stored owner
(`owner/denied`), or cannot be checked because a read failed
(`owner/unavailable`). These are reads only; shadow admission is
unchanged. Shadow applies the same stored-owner rule as enforce but
never writes the link, so it can't predict a later owner-link write
failure, or which of two racing first links wins.

### Admission through the verified owner

- **Owner bans, unconditionally.** `community_ban_outcome` takes the
token owner and checks its ban in place of a NIP-OA owner. That applies
whether the agent is a member itself, the relay is open, or the agent is
admitted through its owner.
- **Owner-derived membership.** In
`api::relay_members::check_membership`, an agent that is a member itself
is still admitted first. Otherwise, when a verified assertion names an
owner, the owner's membership decides (`MembershipDecision::ViaOwner`),
and no NIP-OA is needed on the connection. The issuer has already passed
this community's NIP-FI binding check at that point. When a token owner
is present it is the only owner considered.
- **Stored-owner consistency.** `link_agent_owner` replaces the boolean
`materialize_nip_oa_owner` result with `OwnerLink::{Linked, Conflict,
Unavailable}`. An unset stored owner is recorded, so relay bans and
roster removal of the owner reach the agent through
`revoke_live_access`. Shadow and enforce judge the stored owner through
one read, `stored_owner_link`, and `link_agent_owner` writes
(atomically, first write wins) only when that read finds no owner; a
failed read fails closed. If the stored owner differs from the token
owner, the request is refused with `authorization denied` on HTTP, WS
and audio. A NIP-OA owner conflict keeps its existing link-error
refusal.
- **One decision on every surface.** Root WS AUTH, audio registration
and every NIP-98 HTTP route (bridge, `buzz/v1`, git transport and
settings, invites, media, workflows, moderation reads) pass
`NipFiAdmission::token_owner()` / `VerifiedAssertion::owner()` into the
same ban, membership and owner-link steps. The final socket check
rereads bans and writer-side membership; it doesn't reread the owner
link, which is written once from NULL. HTTP membership still goes
through the bounded replica read. With a verified agent token, every
HTTP admission refusal, including the fresh ban rereads in `buzz/v1` and
Git settings, is NIP-FI's fixed `authorization_denied` (or
`authorization_unavailable` when a dependency fails), and audio checks
bans before writing the owner link. `enforce_relay_membership` now takes
the `TenantContext`, because it writes the owner link.
- **Publishing.** A ban caught while publishing over `POST /events`
after the shared membership check is also an admission refusal. Ingest
reports it as a typed `IngestError::Ban` (banned, or ban lookup
unavailable) at the write gate, the HTTP typing indicator's cached gate,
and the moderation and relay-admin command rereads. `IngestError::Ban`
carries the legacy error. The bridge turns it into the fixed
`authorization denied` / `authorization unavailable` only when the
request carries a verified agent token. WebSocket and token-less HTTP
responses are byte-for-byte unchanged, and timeouts, scopes, permissions
and every other ingest error keep their existing responses.

### Rollout

- **Deploy the relay before kgoose.** An older relay refuses
`nip-fi-agent+jwt`, so agents are locked out until both are deployed.
Humans are unaffected.
- **There is no agent-only switch.** Setting NIP-FI to shadow or off
turns it off for humans too.
- **Rollback is safe for owner links.** Stored owner links survive a
rollback, and the older code still honors them.
- **Shadow signals:** in `buzz_nip_fi_shadow_total`, `stage="owner"`
means an owner would-deny (`owner/denied`) or an owner read that was
unavailable (`owner/unavailable`), not a success. A clean agent
admission shows as `stage="admit", outcome="admit"`.
- **The relay checks that the owner is a member, not which issuer the
owner logged in through.** In a community that trusts several issuers,
any trusted issuer can name any member as owner. That matches the spec:
the issuer is trusted to vouch for the owner, and kgoose requires the
owner's attestation.

Agent tokens are only issued to relays whose NIP-FI binding trusts the
issuer, and NIP-FI itself is off unless configured. No deployed config
or secrets change.

---------

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Co-authored-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz>
Co-authored-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

scripts/run-tests.sh

@@ -370,6 +370,9 @@ run_unit_tests() {
     handlers::auth::tests::fi_invalid_nip42_proof_emits_terminal_evidence_rejected
     handlers::auth::tests::handle_auth_pairing_mismatch_runs_full_root_denial_path
     handlers::auth::tests::shadow_root_auth_records_pairing_denial
+    handlers::auth::tests::shadow_root_auth_records_unavailable_owner_read
+    handlers::ingest::postgres_tests::relay_admin_ban_maps_to_blocked_auth_failure
+    handlers::ingest::postgres_tests::relay_admin_internal_maps_to_error_not_client_fault
     handlers::auth::tests::shadow_root_invalid_nip42_retires_without_record
     handlers::auth::tests::nip42_denial_class_separates_internal_failure_from_bad_evidence
     handlers::event::tests::fanout_access::owner_only_kinds_keep_only_the_owner
@@ -382,6 +385,7 @@ run_unit_tests() {
     state::tests::conn_manager_disconnect_nip_fi_is_issuer_scoped
     state::tests::conn_manager_disconnect_nip_fi_sets_authorization_denied_reason
     state::tests::nip_fi_disconnect_audio_is_issuer_scoped
+    state::tests::nip_fi_owner_disconnect_closes_owned_agent_sockets_on_root_and_audio
     state::tests::nip_fi_disconnect_closes_proven_audio_socket_and_sends_policy_close_reason
     state::tests::nip_fi_disconnect_closes_target_audio_only_and_preserves_collocated_peer
     state::tests::nip_fi_disconnect_does_not_close_different_pubkey_audio_socket