Add Channel Metadata Validation

[adrastaea]

This PR hardens channel metadata storage and subscription readiness for public/private channels.

The main change is replacing permissive channel metadata writes with validated, role-aware OrbitDB metadata writes. Public and private channel metadata now live in separate stores, private channel metadata is encrypted to the channel-specific role, and metadata updates are checked against sigchain identity, team membership, owner, role, and privacy invariants.

Key Changes

• Adds a custom ChannelMetadataAccessController that validates OrbitDB metadata writers, rejects duplicate metadata PUTs for an existing channel key, and restricts metadata DELs to admins (packages/backend/src/nest/storage/channels/orbitdb/ChannelMetadataAccessController.ts:121).
• Splits channel metadata into public and private OrbitDB stores using CHANNEL_METADATA_STORE_NAME and PRIVATE_CHANNEL_METADATA_STORE_NAME (packages/backend/src/nest/storage/channels/channels.service.ts:248, packages/types/src/channel.ts:9).
• Validates channel metadata end-to-end: key must match decrypted channel ID, encrypted payload signer must match owner, writer identity must match the active team, privacy must match the target store, role/public fields are immutable, and private metadata must use the channel role encryption scope (packages/backend/src/nest/storage/channels/channels.service.ts:322).
• Moves channel ID generation to the backend and removes the old client-side channelName_random helper, so clients create channels by name/team/privacy and use the canonical channel returned by the backend (packages/backend/src/nest/storage/channels/channels.service.ts:955, packages/common/src/channelAddress.ts:1).
• Tracks channel subscription as explicit state. The backend emits CHANNEL_SUBSCRIBED after the store is actually subscribed, state-manager records that status, and message sends wait for the target channel subscription before emitting to the backend (packages/backend/src/nest/storage/channels/channels.service.ts:1031, packages/state-manager/src/sagas/publicChannels/waitForChannelSubscription.saga.ts:8, packages/state-manager/src/sagas/messages/sendMessage/sendMessage.saga.ts:90).
• Disables the desktop channel input until the current channel is subscribed, avoiding sends into a channel store that is known but not ready yet (packages/desktop/src/renderer/components/Channel/Channel.tsx:25, packages/desktop/src/renderer/components/Channel/ChannelComponent.tsx:267).
• Improves OrbitDB store registration and lifecycle cleanup so fanout/pending-head replay can resolve stores through address aliases and unregister stores on close/drop (packages/backend/src/nest/storage/orbitDb/orbitDb.service.ts:64, packages/backend/src/nest/storage/orbitDb/orbitDb.service.ts:299).
• Passes log context into log-aware access controllers, which lets metadata validation inspect existing channel metadata log entries (packages/backend/src/nest/storage/orbitDb/keyValueWithStorage.ts:8, packages/backend/src/nest/storage/orbitDb/keyValueWithStorage.ts:64).

Pull Request Checklist

• I have linked this PR to a related GitHub issue.
• I have added a description of the change (and Github issue number, if any) to the root CHANGELOG.md.

(Optional) Mobile checklist

Please ensure you completed the following checks if you did any changes to the mobile package:

• I have run e2e tests for mobile
• I have updated base screenshots for visual regression tests

[islathehut]

Made a few small changes (added tests, small refactors, fixes post-merge from develop) and tests are passing locally. The validation logic looks good to me but I'd like Taea's input on my changes before approving/merging.

[islathehut]

Wanted to note for future us that these changes aren't backwards compatible.