Audit round 2: resource ceilings, key lifecycle, local gate, courtesy logout

BL-21 (medium): untrusted relays and crafted bunker URIs can no longer
buy CPU, memory, or sockets. Frames over 256K chars are dropped before
JSON.parse; buffered queries run every cheap check (id shape, replay
dedup, capacity) BEFORE Schnorr verification and carry a per-query
verification budget (3x limit, floor 50) so distinct forged events
exhaust the budget rather than the CPU; bunker URIs are deduplicated
and capped at 8 relays. The audit's exact probe -- thousands of replayed
copies against limit 1 -- now costs one verification, bounded by test.
Documented trade: a relay that sprays forgeries past the budget forfeits
the query.

BL-22 (low): pending nostrconnect attempts now have a real lifecycle.
Superseding or abandoning an attempt aborts its 180s listener (new
AbortSignal support) and wipes its ephemeral key; on success the key's
ownership transfers into the adopted client, which wipes on close.
Per-candidate conversation keys in the listen loop are wiped in a
finally instead of left to GC.

BL-23 (low): the named local gate no longer skips static analysis --
security:ci runs the custom Semgrep rules via security:semgrep (same
config and pin as the hosted workflow).

BL-24 (informational): the courtesy protocol logout defined by current
NIP-46 is sent on every teardown path (disconnect, supersession),
bounded at 2s and never allowed to block closing; TODO's outdated 'no
stable method name' note is corrected. switch_relays remains the one
deferred interop item.

6 new adversarial tests; 262 total, all green; semgrep gate exit 0.

Co-Authored-By: Claude Fable 5 <[email protected]>

docs/TODO.md

@@ -28,9 +28,18 @@ signed events against the request (signature, identity, field equality);
 `Nip46Client.close()` wipes the client and conversation keys; passkey
 labels are distinguishable; postcss ≥8.5.25; Actions pinned to commit SHAs.
 
-Deferred from the audit, non-security interop items: NIP-46 protocol-level
-logout on teardown (no stable method name across deployed signers) and the
-recommended `switch_relays` request.
+Second-pass response (same day): BL-21 — bunker relays capped at 8 and
+deduplicated; relay frames over 256K chars dropped before JSON.parse; all
+cheap checks (id dedup, capacity) run before Schnorr verification, plus a
+per-query verification budget. BL-22 — superseded/abandoned nostrconnect
+attempts are cancelled via AbortSignal and their ephemeral keys wiped
+(ownership transfers, not dangles, on success); per-candidate conversation
+keys wiped in a finally. BL-23 — `security:ci` now runs the custom Semgrep
+rules (`security:semgrep`; requires a local semgrep install, same pin as
+CI). BL-24 — the courtesy protocol `logout` (current NIP-46 defines it,
+explicitly not a security boundary) is now sent on teardown; this corrects
+the earlier "no stable method name" note. Still deferred, interop only:
+`switch_relays`.
 
 Owner action items: