feat(auth): add NIP-FI canonical assertion verifier and contracts - #6776

The pass-1 fix bound each AssertionKeySet to an issuer and compared that
label to the policy at verify time, but verify() still took the snapshot
as a caller argument and AssertionKeySet::new is public. A request-path
caller could therefore construct issuer B's JWKS labelled issuer A and mint
a sealed (A, victim) identity — the cross-issuer key-source confusion was
only detected for honest mislabelling, not prevented.

Make the key source structural: FederatedAssertionVerifier holds a trusted
IssuerKeySource and resolves the snapshot internally by the token's
signature-authenticated iss. verify() now takes only the token, so there is
no seam through which a caller can supply or relabel key material. A missing
snapshot for a registered issuer is an unreadable authoritative dependency
(KeySourceUnavailable -> AuthorizationUnavailable), not rejected evidence.
A defensive re-check still denies a source that violates its issuer-binding
contract. PR 3 supplies a live-refreshing IssuerKeySource additively.

Co-authored-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

…r-contracts

* origin/main:
  Qualify canonical relay images for staged delivery (#6781)
  feat(desktop): persist agent addressing across composer messages (#6714)
  feat: navigate images across message threads (#6705)
  Add database pressure observability (#6700)
  revert fixed mention highlight (#6716)
  highlight search terms in results and messages (#6702)
  fix(desktop): make lightbox zoom controls interactive (#6710)
  Support community deletion in versioned media buckets (#6738)
  Fix TipTap editor mount race (#6779)
  feat(buzz-agent): gate LLM tool calls on session/request_permission (#5712)
  Add staging dev relay image workflow (#6709)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

The pass-2 fix moved cross-issuer forgeability off the verify() request seam
but left it at the authority-construction seam: AssertionKeySet::new and the
IssuerKeySource trait were public, so an external buzz_auth consumer could
build a source returning issuer B's JWKS labelled as issuer A, pass it to the
public FederatedAssertionVerifier::new, and mint a sealed (A, victim) identity.

Make the accepted issuer->JWKS authority entirely crate-owned:
- IssuerKeySource gains a private sealed supertrait, so no external crate can
  implement it.
- AssertionKeySet::new becomes pub(crate); a test-utils-gated for_test keeps
  the crate-owned source usable from integration tests.
- A crate-owned, test-utils-gated StaticIssuerKeySource replaces the external
  MapKeySource the tests defined.

compile_fail doctests (compiled as external consumers) prove neither the trait
nor the constructor can be named from outside the crate.

The verifier's regression suite lived outside 'just test-unit' (which runs
buzz-auth --lib only), so it ran in no CI job. Add the integration suite
(--features test-utils) and the doctests to the unit-test recipe so the
cross-issuer regression and the seal are actually gated by CI.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

…r-contracts

* origin/main:
  Remove public relay signing key fallback (#6729)
  docs(nest): make commit attribution policy-neutral (#6707)
  fix(desktop-messages): preserve inline agent mentions with persistent addressing (#6793)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

A downstream-selectable Cargo feature is not an access-control boundary:
features are unified and any dependent could enable buzz-auth's test-utils to
reach AssertionKeySet::for_test and the StaticIssuerKeySource, reconstruct a
relabelled issuer->JWKS authority, and mint a sealed (A, victim) identity from
issuer B's real key.

Remove for_test entirely, gate StaticIssuerKeySource and its sealed
IssuerKeySource impl on cfg(test) only, and move the verifier regression suite
into an in-crate #[cfg(test)] mod tests so it reaches the pub(crate)/cfg(test)
primitives with zero public feature surface. No supported feature set now
exposes an authority-relabelling path; the compile_fail doctests remain as a
default-feature seal regression.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Moving the constructor's only callers under cfg(test) left the non-test
lib build with no caller, so clippy -D warnings rejected it as dead code
(Rust Lint, Windows Rust). PR 3's JWKS runtime is the intended non-test
consumer; narrowly allow dead_code on this one item until it lands rather
than deferring the constructor or widening the lint. expect would misfire
because the lint does not trigger under cfg(test). Also repoint a stale
test comment at the two real compile-fail doctests.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

The dead_code compile error previously masked this: clippy could not
reach empty_line_after_doc_comments until the lib built. The /// block
above test_jwks is module narrative about the shared source, not that
function's API docs, so convert it to // and remove the trailing blank.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>