relay: event expiry is checked against a clock captured before the stream #953

handlers/subscribe.rs: is_expired_event(&event, now) uses a now captured once before the stored-read loop, while the comment beside it claims the guard is asked per event so a mid-read AUTH applies. The authorization genuinely is per event; the clock is not, so an event that expires while earlier records are being fetched is still delivered. The TypeScript path reads the clock per event.

Fix: read the clock per event.

Evidence: #948.