feat(nip-fi): harden Blossom kind-24242 verifier to NIP-FI spec

Brings buzz-media/src/auth.rs, buzz-relay/src/api/media.rs, and the
desktop token minting into full compliance with NIP-FI §kind-24242.

Changes:

buzz-media/src/auth.rs:
- Add BlossomStrictness enum (Strict | Permissive). Strict applies full
  NIP-FI rules; Permissive preserves pre-NIP-FI Off-mode behavior
  byte-identical [FI-INV-15].
- Rewrite verify_blossom_auth_event_for_verb with count-based cardinality
  tracking: exactly one t/expiration/server (Strict), at most one x.
- Strict: mandatory server tag on all proofs (upload + read); absent or
  mismatched -> evidence_rejected (ServerMismatch).
- Strict: 60s proof window (now - created_at <= 60s, expiration <=
  created_at + 60s).
- Permissive: 3600s window, optional server, tolerant cardinality (Off-mode).

buzz-media/src/error.rs:
- Add DuplicateTag(&'static str) variant.
- Split IntoResponse: missing Authorization -> 401 (missing_evidence);
  wrong scheme, malformed, duplicate tags -> 403 (evidence_rejected).

buzz-relay/src/api/media.rs:
- Add blossom_strictness_from_state() helper (TODO: wire to
  config.nip_fi.mode when #7264 lands; defaults to Permissive on main).
- extract_blossom_auth: detect and reject repeated Authorization header
  values -> DuplicateTag("Authorization") -> 403.
- Both call sites (upload + read) now pass strictness to verifier.

desktop/src-tauri/src/commands/media.rs:
- sign_blossom_upload_auth: server tag now mandatory (errors if relay
  URL yields no authority); was conditional.
- Upload token expiry: 60s unconditionally (was 3600s video / 300s image).
- MEDIA_GET_AUTH_EXPIRY_SECS: 60s (was 600s).

desktop/src-tauri/src/media_proxy.rs:
- proxy_handler + handle_buzz_media: single re-mint+retry on 401 or 403
  for range requests (expired 60s token mid-stream).

docs/nips/NIP-FI.md:
- Remove stale compliance note; replace with resolved statement.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

Author: Duncan