feat(relay): add SubscriptionManager (L1) + direct-pool-access lint guard

P1 foundation of the data-flow refactor (docs/architecture-refactor.md):

- js/nostr/subscriptionManager.js: the single chokepoint for relay reads.
  Builds on relaySubscriptionService (dedup by key) and adds: health-gated
  default relays, deduped one-shot list() with timeout, and a reconnect
  registry that re-issues active subs centrally (instead of every subsystem
  re-subscribing on reconnect — the storm amplifier). Callers pass batched
  filters (one REQ for many ids), never per-item.
- Export RelaySubscriptionService class for test isolation.
- scripts/check-direct-pool-access.mjs + lint:pool-access: fail on NEW direct
  pool.sub/list usage; 12 grandfathered files listed as migration targets
  (allowlist may only shrink).

Nothing rewired yet — additive. Pilot (video feed) and per-subsystem
migration follow. Cheat-resistant tests included.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

package.json

@@ -17,7 +17,7 @@
     "ci:beacon": "npm run build:beacon",
     "format": "prettier --cache --write css/tailwind.source.css css/tokens.css css/docs.css \"docs/**/*.html\" tailwind.config.cjs README.md CONTRIBUTING.md",
     "audit": "node scripts/daily-design-system-audit.mjs",
-    "lint": "npm run lint:css && npm run lint:hex && npm run lint:inline-styles && npm run lint:tokens && npm run lint:tailwind-brackets && npm run lint:tailwind-colors && npm run lint:file-size && npm run lint:innerhtml && npm run lint:assets && npm run lint:sw-compat",
+    "lint": "npm run lint:css && npm run lint:hex && npm run lint:inline-styles && npm run lint:tokens && npm run lint:tailwind-brackets && npm run lint:tailwind-colors && npm run lint:file-size && npm run lint:innerhtml && npm run lint:assets && npm run lint:sw-compat && npm run lint:pool-access",
     "lint:file-size": "node scripts/check-file-size.mjs",
     "lint:innerhtml": "node scripts/check-innerhtml.mjs",
     "lint:css": "stylelint css/tailwind.source.css css/tokens.css css/docs.css",
@@ -59,7 +59,8 @@
     "torch:lock": "npm run --prefix torch lock:lock",
     "torch:health": "npm run --prefix torch lock:health",
     "torch:memory:list": "node torch/bin/torch-lock.mjs list-memories",
-    "torch:memory:inspect": "node torch/bin/torch-lock.mjs inspect-memory"
+    "torch:memory:inspect": "node torch/bin/torch-lock.mjs inspect-memory",
+    "lint:pool-access": "node scripts/check-direct-pool-access.mjs"
   },
   "devDependencies": {
     "@playwright/test": "^1.58.2",