Peering: treat authenticated peer connections as feeds, not clients #934

Part of the relay peering work in #931.

Scope

Builds on peer authentication (the NIP-42 peering identity work). Connections authenticated as configured peers get feed treatment instead of client treatment:

• Peer-specific rate limits and subscription caps (configurable separately from client limits; a peer firehose subscription must not trip the EWMA client limiter or max_subscriptions).
• Peers are eligible for unrestricted full-feed subscriptions within their agreed scope.
• Ordinary client protections (EWMA rate limiting, admission, PoW) are unchanged for everyone else, and an unauthenticated connection can never receive peer treatment by asking.

Acceptance

• An authenticated peer can hold a full-feed subscription indefinitely without being rate-limited as a client.
• The same subscription from an unauthenticated or unconfigured connection is limited/rejected exactly as before this change.
• Peer limit settings are documented and validated.