[codex] fix channel metadata validation

[holmesworcester]

Summary

This closes the forged channel metadata hole by validating decrypted channel metadata against the signer, key, encryption scope, and deterministic role naming before indexing a channel metadata PUT.

What changed

• Require channel metadata keys to match decrypted channel ids.
• Require encrypted metadata userId to match the payload signature author and active team.
• Require public channel metadata to be encrypted to the member role and not declare a channel role.
• Require DM metadata to be private, keyed by the deterministic DM id for memberIds, signed by a participant, and encrypted to the deterministic DM role for those participants.
• Require private channel metadata to use the deterministic private-channel role and be signed by a member of that role.
• Add regression coverage for valid DM/private metadata plus forged broad-role and TEAM-scoped private metadata.

Validation

• npm run lint:no-fix -- src/nest/storage/channels/channels.service.ts src/nest/storage/channels/channels.service.spec.ts
• npm run build -- --pretty false
• NODE_OPTIONS="--experimental-vm-modules" DEBUG=ipfs:*,backend:* npx -y node@20.20.1 node_modules/jest/bin/jest.js --runInBand --verbose --testPathIgnorePatterns=".src/(!?nodeTest*)|(.node_modules*)" --detectOpenHandles --forceExit src/nest/storage/channels/channels.service.spec.ts

Note: running the same Jest command through the local default Node v24.13.0 fails during SigChainService.createChain() setup with a msgpackr RangeError. The repo pins Node 20.20.1; the focused spec passes under that version.