fix(dm): restore missing participant memberships

[ghostelle1]

Summary

Restore missing or soft-removed members when an active participant reopens an existing immutable DM.

• Lock the DM participant set and repair inactive membership rows atomically instead of returning an unusable existing room.
• Require the opener to remain an active participant, preserve active peers' hidden state, and unhide only the reopened/restored memberships.
• Invalidate membership caches and refresh discovery, visibility, and global membership notifications after recovery.
• Give each membership transition a collision-resistant signed tag so same-second concurrent notifications cannot be deduplicated into one event.
• Return a client-visible restricted rejection when a removed participant attempts recovery instead of surfacing a server error.

Related issue

None found.

Testing

• cargo test -p buzz-db (114 unit tests + 2 source tests passed)
• PostgreSQL DM recovery tests: 5 passed, including multi-peer and concurrent reopen coverage
• cargo test -p buzz-relay -- --test-threads=1 (996 lib + 13 binary tests passed)
• cargo test -p buzz-test-client (full default suite passed)
• Live relay E2E: removed sender rejected, active peer reopened the DM, kind:44100 arrived live, the negative membership cache was invalidated, and the restored sender posted successfully
• cargo clippy -p buzz-db -p buzz-relay -p buzz-test-client --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check

The parallel relay suite also hit its existing process-global tracing test interference once; the full serial package run above passed. just ci was not run because Docker is unavailable in this environment.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is eed74bde2f4797714335ac10c56c0b0244c1def4...7c2af82a3fb5c4a3efd37c02d1374f89d0a1ce59.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 7c2af82a3fb5c4a3efd37c02d1374f89d0a1ce59 to authorize a new review.
Any previous review applies only to its recorded range.