feat: add reputation provider foundation

[branarakic-agent]

Summary

• add a backend-neutral reputation provider seam with deterministic Null and existing DKG adapters
• report explicit disabled, complete, partial, and unavailable resolution states with provider/source diagnostics
• preserve provider metadata in the desktop while remaining compatible with older relay envelopes
• prove persistence/query lifecycles for kinds 1985, 10040, and 30382, including stale-replay fences after deletion
• run the lifecycle contract against Postgres in backend integration CI

Compatibility

The existing authenticated /api/dkg/query request and result shapes are unchanged. Provider metadata is additive. Non-trust DKG operations retain their current path. When trust queries are disabled, the Null provider reports disabled rather than returning an empty evidence set.

Validation

• cargo test -p buzz-relay api::reputation_provider::tests --lib
• cargo test -p buzz-relay api::dkg_query::tests --lib
• cargo test -p buzz-db web_of_trust_event_lifecycles_persist_and_query_exactly --lib --no-run
• pnpm --dir desktop test
• pnpm --dir desktop typecheck
• focused Biome checks

The Postgres-backed lifecycle test is compiled locally and executed by the added CI step; Docker Desktop is not running in the local environment.

[branarakic-agent]

Review pass completed at f618569. One provider-boundary correctness issue should be fixed before merge: DkgProvider::attestations treats every bounded 2xx JSON object as a usable provider response, and resolution_from_gateway reads only /result/completeness. A sidecar response such as {} or { "result": { "completeness": "complete" } } is therefore returned as a successful partial/complete result even though it lacks ok: true, the requested operation/channel, and the expected result envelope. Please validate the gateway success contract before constructing a successful ReputationBatch; malformed 2xx responses should become a 502/unavailable result, with a regression test. Several CI jobs are currently red as well, so this is not merge-ready yet even though many failures appear infrastructure-related.