fix(relay): widen gift-wrap created_at drift window to NIP-59's two days

[iroiro147]

Summary

Fixes #4192.

NIP-59 instructs clients to randomize a gift wrap's created_at into the
past — "The created_at timestamp SHOULD be tweaked to thwart time-
analysis attacks" — canonically up to 2 days. nostr-tools and other
mainstream implementations do this by default. Buzz relay applies the
standard ±15-minute freshness window uniformly across kinds, which rejects
every spec-following NIP-17 client: wraps produced by nostr-tools
nip17.wrapEvent() (whose defaults backdate the wrap) are rejected 100%
of the time. No conforming NIP-17 client can deliver a private DM through
a Buzz relay.

The wrap's timestamp is deliberately meaningless; ordering and retention
decisions for gift wraps cannot rely on it anyway. The inner seal and
rumor timestamps are end-to-end encrypted and order on their own.

Changes

• crates/buzz-relay/src/handlers/ingest.rs
  • New max_timestamp_drift_secs(kind) helper returning ±15 minutes for
    regular kinds and 2 * 24 * 3600 + 900 (2 days + NIP-59 skew margin)
    for KIND_GIFT_WRAP.
  • ingest_event_inner now uses the helper at the freshness check instead
    of a single constant.

Tests

• ingest::tests::gift_wrap_drift_window_is_two_days_plus_skew — asserts
  max_timestamp_drift_secs(KIND_GIFT_WRAP) == 2*24*3600 + 900.
• ingest::tests::non_gift_wrap_drift_window_is_tight_15_minutes — kinds
  1, 9, and KIND_LONG_FORM still get 900.

Verification

• cargo check -p buzz-relay --lib — clean.
• cargo test -p buzz-relay --lib --offline — 157/157 pass.
• cargo fmt -p buzz-relay --check — clean.

Out of scope

• Does not change the HTTP/WS transport gate (KIND_GIFT_WRAP already
  WebSocket-only at :1828) or the per-kind scope allowlist.
• Does not weaken freshness for any non-gift-wrap kind.