feat: isolate view telemetry and restrict session actor publishing

- Add `isSessionActor` helper to `js/nostr/sessionActor.js` to identify ephemeral keys.
- Update `js/nostr/viewEvents.js` to namespace view deduplication caches by `actorPubkey` to prevent data leakage between sessions.
- Block comment publishing for session actors in `js/nostr/commentEvents.js`.
- Block watch history list publishing for session actors in `js/nostr/client.js`.
- Block user block list publishing for session actors in `js/userBlocks.js`.
- Block hashtag preference publishing for session actors in `js/services/hashtagPreferencesService.js`.
- Add inline documentation clarifying variable sources.

js/services/hashtagPreferencesService.js

@@ -4,6 +4,7 @@ import {
   requestDefaultExtensionPermissions,
 } from "../nostrClientFacade.js";
 import { getActiveSigner } from "../nostr/index.js";
+import { isSessionActor } from "../nostr/sessionActor.js";
 import {
   buildHashtagPreferenceEvent,
   getNostrEventSchema,
@@ -700,6 +701,15 @@ class HashtagPreferencesService {
   }
 
   async publish(options = {}) {
+    // nostrClient imported from nostrClientFacade
+    if (isSessionActor(nostrClient)) {
+      const error = new Error(
+        "Publishing preferences is not allowed for session actors."
+      );
+      error.code = "session-actor-publish-blocked";
+      throw error;
+    }
+
     const targetPubkey = normalizeHexPubkey(
       typeof options?.pubkey === "string" ? options.pubkey : this.activePubkey,
     );