nip71: inbound ingest service (whitelist-scoped, default on)

Pulls NIP-71 video events published by other Nostr apps (kinds
21/22/34235/34236), converts them via the ingest adapter, and injects
them into nostrClient.activeMap/allEvents so they flow through the
existing feed pipeline. Gated by FEATURE_NIP71_INGEST.

Mirrors bitvid's whitelist model: since the whitelist is "authors
allowed to publish/render here," ingest scopes its relay subscription to
whitelisted pubkeys while whitelist mode is on (bounded, no firehose) and
re-subscribes when the whitelist changes. When a deployer disables
whitelist mode, ingest opens to all authors (capped by a limit). Foreign
content is still gated by the same render-time filter
(shouldIncludeVideo -> accessControl.canAccess): whitelist, blacklist,
NSFW (content-warning -> isNsfw), private-skip, plus trust/mute/blur from
the feed engine. Native bitvid videos always win a shared root; among
ingested videos newest wins. Refreshes via the existing videos:updated
reactive path.

- accessControl.getWhitelistPubkeys(): hex whitelist for subscription scope.
- Wired in applicationBootstrap (start on init, stop on teardown).
- nostrService untouched (at its size cap); logic is a standalone service.

Mutation-verified: native-wins, whitelist scoping, feature gate.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

js/ui/applicationBootstrap.js

@@ -18,6 +18,7 @@ import NwcSettingsService from "../services/nwcSettingsService.js";
 import nostrService from "../services/nostrService.js";
 import storageService from "../services/storageService.js";
 import { initNip71MirrorSync } from "../services/nip71MirrorSync.js";
+import { createNip71IngestService } from "../services/nip71IngestService.js";
 import watchHistoryService from "../watchHistoryService.js";
 import r2Service from "../services/r2Service.js";
 import s3UploadService from "../services/s3UploadService.js";
@@ -853,6 +854,24 @@ export default class ApplicationBootstrap {
     // Keep an opted-in NIP-71 mirror in lockstep on edit/delete (event-driven so
     // nostrService stays untouched).
     nostrUnsubscribes.push(initNip71MirrorSync(app.nostrService));
+
+    // Inbound NIP-71 ingest: pull video events published by other Nostr apps
+    // (scoped to whitelisted authors while whitelist mode is on) and surface
+    // them in the feed. Gated by FEATURE_NIP71_INGEST. Best-effort.
+    const nip71IngestService = createNip71IngestService({
+      nostrClient,
+      nostrService: app.nostrService,
+      accessControl,
+    });
+    app.nip71IngestService = nip71IngestService;
+    if (nip71IngestService.isAvailable()) {
+      try {
+        nip71IngestService.start();
+      } catch (error) {
+        devLogger.warn("[applicationBootstrap] NIP-71 ingest start failed", error);
+      }
+      nostrUnsubscribes.push(() => nip71IngestService.stop());
+    }
     nostrUnsubscribes.push(
       app.nostrService.on("directMessages:notification", () => {
         void app.refreshUnreadDmIndicator({ reason: "dm-notification" });