fix(channels): reject malformed Buzz key padding

[RerankerGuo]

Why

NIP-19 encodes a 32-byte key as 52 five-bit bech32 words. The last word has
four padding bits that must be zero, but the Buzz decoder discarded those bits
without validating them. A checksum-valid npub or nsec with nonzero padding
was therefore accepted as an alias of a canonical key.

For example, the malformed but checksum-valid
npub1lycg5qvjtrp3qjf5f7zl382j9x6nrjz9sdhenvyxq8c3808qxmu3875l8g
was accepted as
f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9.

What changed

• Reject a bech32 key when discarded payload bits are nonzero.
• Add fixed checksum-valid malformed vectors for both npub and nsec.

Canonical hex, npub, and nsec inputs are unchanged.

Surface area

• Frontend UI - page / component / setting / interaction under frontend/
• Backend API - endpoint / request-response shape under backend/app
• Agents / LangGraph - agent node, graph wiring, or prompt change
• Sandbox - docker/ or sandboxed execution
• Skills - change under skills/
• Dependencies - new/upgraded dependency
• Default behavior change - only malformed Buzz key strings are rejected
• Docs / tests / CI only - includes a runtime parser correction

Screenshots / Recording

Not applicable.

Bug fix verification

• Red on main: both checksum-valid malformed vectors were accepted
  (34 passed, 2 failed).
• Green after the fix: Buzz suites pass (141 passed).

Validation

• cd backend && PYTHONPATH=. uv run --extra buzz pytest tests/test_buzz_nostr.py tests/test_buzz_channel.py -q - 141 passed
• cd backend && make test with the Buzz extra installed -
  11204 passed, 72 skipped
• Focused Ruff lint and format checks passed
• git diff --check passed

Duplicate check

Searched all open PR titles and bodies for bech32, padding, npub,
nsec, Buzz, and Nostr; no active implementation was found.

AI assistance

Tool(s) used: TRAE

How you used it: Audited the newly merged Buzz parser, generated fixed
checksum-valid malformed vectors, wrote the failing regression first, applied
the minimal decoder check, and ran focused plus full validation. I reviewed the
final diff and can explain each changed line.

• I've read and understand every line of this change and take responsibility for it - it's not unreviewed AI output.