buzz-db: check the floor only on newly inserted event rows

Review rework for the insert-time created_at floor (BUZZ-316 phase 1).

- Ordinary and thread event writers now run the floor check after their
  ON CONFLICT DO NOTHING INSERT, only when a row was inserted and before
  follow-ups. Replaying an already-stored id stays Duplicate even when
  its created_at has aged below the floor, matching the trigger.
- Source policy: UPDATE rule catches ONLY, aliases and row-constructor
  column lists; quoted identifiers are normalized; the floor policy
  scans every crate's src via the shared workspace walk.
- NIP-43 membership insert writes a literal NULL channel_id, pinned
  positionally; the bind-based exemption is gone.
- Canvas CAS fixtures take a per-test base instead of a process-wide
  OnceLock.
- seed-admin-dashboard.sh also refuses PGHOSTADDR, PGSERVICE and
  multi-host PGHOST.

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>

scripts/seed-admin-dashboard.sh

@@ -20,6 +20,10 @@ export PGPASSWORD="${PGPASSWORD:-buzz_dev}"
 export PGDATABASE="${PGDATABASE:-buzz}"
 
 # This raw fixture writer is unarmed and must never target a live replica fence.
+if [[ -n "${PGHOSTADDR:-}" || -n "${PGSERVICE:-}" || "${PGHOST}" == *,* ]]; then
+  echo "error: admin seed requires a local PostgreSQL target without PGHOSTADDR, PGSERVICE or multiple hosts" >&2
+  exit 1
+fi
 case "${PGHOST}" in
   localhost|127.0.0.1|::1|/*) ;;
   *)