feat: Add PUT /report endpoint and GET / terms of service (BUD-09)

[kengirie]

Summary

• Add PUT /report accepting a signed NIP-56 (kind 1984) event with one or more x tags. Each tag MUST contain a 64-hex sha256 and one of the seven NIP-56 report types (nudity / malware / profanity / illegal / spam / impersonation / other). Validated reports are persisted to a new blob_reports table.
• Add GET / returning a text/plain Terms of Service describing acceptable use, size limits, and how to file reports (BUD-09 SHOULD).
• Validation is strict: bad JSON, wrong kind, unknown report type, malformed sha256, or signature mismatch → 400.

Notes

• No authentication header is required — the NIP-56 event is itself signed.
• Reports for blobs not stored on this server are still accepted (BUD-09 does not require server-side existence).
• The "Servers MAY consider removed blobs sha256 as blocked" option from the spec is intentionally NOT implemented; DELETE still allows re-upload of the same sha256.

Test plan

• dune build
• dune runtest — 290 unit tests pass, including 11 new Report tests (valid event, multiple x tags, e/p tag preservation, wrong kind, missing x, invalid sha256, invalid report type, missing type field, tampered signature, malformed JSON)
• dune exec e2e/main.exe — all suites pass, including 5 new BUD-09 e2e tests (GET / ToS, PUT /report accepted, multiple x tags, invalid body → 400, unknown type → 400)
• Manual: curl http://localhost:8082/ returns 200 with the ToS body

🤖 Generated with Claude Code