fix(relay): correct pagination and counts for existing private queries

[loganj]

Summary

Fix pagination and COUNT candidate-budget correctness for existing author-only queries, including the existing reminder event family. Rows that are not visible to the current reader should not consume a visible page or the bounded COUNT fallback's candidate budget.

• Carry the reader into existing HTTP/WS query construction.
• Apply the existing author-only visibility predicate in SQL before ordering, offset and LIMIT; retain existing result filtering and COUNT fallback/over-budget checks.
• Keep production NIP-98 authentication and the intentional development-mode X-Pubkey contract unchanged. The earlier extra development-mode proof requirement has been removed from this draft.
• Keep a PostgreSQL-backed HTTP/WS regression covering owner/outsider visibility, mixed pages, known IDs, tied timestamps, offset/cursor pagination and COUNT budget behavior. HTTP cases use each mode's existing identity contract.

This is pagination/count correctness only, not authentication hardening or a new private-content feature. No new kinds, schema, lifecycle or client changes. Closest related PR: #7322 (new owner-private intent), unchanged and outside this scope.

Candidate: 5e51c4fa5096f08f20b34d43d09c659ec75e871b (one additive scope-reduction commit over the original draft). Net diff: 4 files, 290 additions / 5 deletions. Original merge-base: 01bacb8df3d2f5718e0a468828e07ae874a38eae; no merge commit or history rewrite.

Validation on this candidate

Using installed pinned Rust tools and existing dependency caches, offline:

• Focused bridge tests: 64 passed, 7 ignored; REQ tests: 55 passed.
• Existing NIP-98 verifier tests: 14 passed, including real signature and URL/method validation. Production bridge code is byte-identical to the base after excluding test-module wiring.
• Broader package libraries attempted once: buzz-db 122 passed, 252 ignored; buzz-relay 1021 passed, 13 failed, 90 ignored. The 13 failures occur at sandbox-denied network operations: six media cases attempting DB fixture setup, six localhost mock/listener cases, and a metrics child reporting Bind instead of RecorderConflict. This is not an all-package pass. Focused passes above overlap with the package run and are not additional unique tests.
• Relay/DB all test targets compiled (--no-run); relay/DB all-target clippy with warnings denied passed.
• Four-file Rust formatting, diff whitespace, PostgreSQL test discovery, and all three surface size ratchets passed; size policy suite 10 passed.

Initial remote CI

New-head CI run 33888392074 is in progress. Initial DCO and Desktop Release Candidate checks passed; relay/Rust/PostgreSQL results are not yet available. Skipped review jobs are not review acceptance.

Pending / draft limits

• The updated PostgreSQL HTTP/WS regression is compiled, not behaviorally executed locally. No authorized isolated desired-schema PostgreSQL/Redis fixture is available. Baseline/final storage behavior and reader/SQL mutation controls remain pending; normal remote CI is the next evidence source.
• No full local just ci / just test pass. No installs, provisioning or runtime changes were made to obtain a green result.
• The fixture bypasses replay tracking and relay membership and injects WS authenticated state; it does not certify replay, closed membership or the NIP-42 handshake. Large-budget coverage is HTTP-only. No new FTS guarantee.
• No native/live acceptance, deployment, or merge-readiness claim. Ignored/skipped checks are not passes.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is cd02b693aae86444b0b5636474a3d202c6fc8f26...5e51c4fa5096f08f20b34d43d09c659ec75e871b.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 5e51c4fa5096f08f20b34d43d09c659ec75e871b to authorize a new review.
Any previous review applies only to its recorded range.