[BUG] NIP-42 auth not enforced on reads (kinds 4, 1059 leak to anyone) #699

Describe the bug

Kind 4 DMs and kind 1059 gift wraps are handed out to anyone who asks for them. We support NIP-42 AUTH but never actually check it on reads, so an unauthenticated client can just REQ for these kinds and pull down everyone's encrypted messages, ciphertext plus who-talks-to-who metadata. COUNT and live broadcasts leak the same way.

To Reproduce

1. Run the relay (v3.0.0) with some users exchanging kind 4 / 1059 events.
2. Connect without authenticating and send ["REQ", "sub", {"kinds": [4]}].
3. You get back every user's DMs, including ones you're neither the author nor a p recipient of.
4. COUNT and post-subscribe live events behave the same.

Expected behavior

Restricted kinds should only go to clients that have authenticated as the event author or a tagged p recipient. Needs to hold for REQ, live broadcasts, and COUNT.

COUNT can't be filtered per-event, so any COUNT touching a restricted kind has to be scoped to the caller's own pubkeys via authors/#p.

If a subscription only asks for restricted kinds and the client isn't authenticated, close it with auth-required: so the client knows to auth and retry, instead of silently returning nothing.