fix: prevent receipt-authorized relay deletion

[vessenes]

What changed

• make signed read receipts telemetry-only and keep message retention under server TTL control
• remove the internal receipt-triggered clear route and all receipt-driven KV deletion
• stop the public stats response from exposing conversation IDs and per-conversation timestamps
• add relay security-policy tests, typechecking, and a CI job
• document the retained required_acks field as a legacy wire-compatibility hint

Why

The relay cannot infer conversation membership from opaque envelopes. Any arbitrary key could sign a receipt, choose required_acks=1, and delete a known message. Public stats also made conversation discovery easier.

Validation

• relay security tests: 3 passed
• relay TypeScript typecheck passed
• Wrangler deploy dry-run passed
• client Dropbox transport tests: 14 passed
• client build passed
• downstream PR Add cross-surface UI acceptance gate #22 posts a real message, submits a valid one-ack receipt from an arbitrary key, and proves the message is still replayable

Stack

This PR targets PR #18. PR #22 is stacked above it and runs the combined browser/CLI/TUI/gateway/relay acceptance gate.