feat(archive): add local-save archive with subscription UI

[wpfleger96]

Add local SQLite archive for relay messages (P1–P3).

What this does

Adds a complete local-save archive feature: users can subscribe to specific channels or scopes, the app opens live relay subscriptions for each saved config, and matched events are persisted to a per-identity SQLite database in the Buzz nest (~/.buzz/archive/archive.db).

Backend (P1–P2)

Four Tauri commands: create_save_subscription, list_save_subscriptions, delete_save_subscription, archive_events.

Access control at every stage:

• Subscribe-time: create_save_subscription runs a per-scope access probe against the relay (NIP-98 authed /query). Channel memberships are verified via kind 39002 + open-channel fallback. Event readability via ids filter. owner_p restricted to current identity's own pubkey.
• Persist-time: archive_events re-verifies every candidate via scoped relay query ({ids, #h/#e, kinds}). The relay returning the event IS the proof of scope membership — no local tag re-derivation, so h-less channel events can persist when relay confirms them. Only events the relay returns are written.
• Ephemeral path (owner_p, kind 24200 observer frames): relay never stores these, so local validation applies instead (sig/id + kind + #p + agent tag + frame=telemetry + author == agent).

Subscription kinds enforcement: both paths filter by the subscription's allowed kinds list before insert.

SQLite schema (archive/store.rs): three tables — archived_events (raw JSON + metadata), archived_event_scopes (many-to-many), save_subscriptions. WAL mode. GC: raw event rows are removed when their last scope row is deleted. Idempotent upserts.

Send-safety: rusqlite::Connection is !Send. All DB work is bracketed in sync plan_archive / commit_archive functions that drop the connection before any .await, matching the pattern in persona_events.rs. Pipeline internals live in archive/pipeline.rs to keep mod.rs under the 1000-line file-size gate.

Frontend (P3)

tauriArchive.ts — typed wrappers for all 4 commands. The SaveSubscription.kinds column is stored as a JSON text string in SQLite; the wrapper decodes it to number[] once at the boundary, failing closed on malformed JSON. ArchiveCandidate struct fields use verbatim Rust snake_case names (raw_event_json, matched_scope, scope_type, scope_value) — Tauri 2 only camelCases top-level command arg names, not nested struct fields. Emits a module-level subscription-change notification after create/delete.

archiveSyncManager.ts — always-on manager started at AppShell mount via useArchiveSync(). Opens one live relay subscription per saved config (channel_h → #h, owner_p → #p, referenced_e → #e; all limit: 0 for live-only). Buffers matched events and flushes to archive_events in batches (≥25 events or 2s idle). Resubscribes automatically on subscription-change signal. Tears down cleanly on workspace switch, flushing buffered events.

LocalArchiveSettingsCard.tsx — settings UI at Settings → Local Archive (Archive icon, no feature gate, opt-in by construction). Lists active subscriptions with delete. Add flow for:

• channel_h: channel picker from joined channels + kind preset checkboxes. Presets derived from CHANNEL_MESSAGE_EVENT_KINDS + KIND_STREAM_MESSAGE_DIFF (Messages & posts), CHANNEL_AUX_EVENT_KINDS (Reactions, edits & deletions), and CHANNEL_EVENT_KINDS (All channel activity). No raw numeric literals.
• owner_p: fixed kinds [24200] (agent observer frames).
• referenced_e: backend-only in v1 (no sane UI affordance for "paste an event id").

Tests

Rust (39 tests, src-tauri): persistent path (channel_h + referenced_e persist/drop, h-less events via scoped relay proof), kind mismatch drops on both paths, no-subscription drops, mixed batch exact counts, ephemeral path (valid/invalid frames, kind enforcement, missing tags, tampered events), store schema (idempotent upserts, GC, list scoping).

JS (20 new tests, archiveSyncManager.test.mjs): kinds decoding (valid, empty, non-array, wrong types, malformed JSON), preset kind arrays (exact saved arrays asserted, verified against constants — edits not misclassified as messages, forum kinds included), subscription-change notifier contract, manager lifecycle (filter shapes, flush on batch size, resubscribe on create/delete, flush on destroy).

E2E (click-path, local)

With just dev from the worktree:

1. Settings → Local Archive → choose a channel → select event types → Save
2. Chat in that channel
3. sqlite3 ~/.buzz-dev/archive/archive.db 'SELECT id,kind FROM archived_events; SELECT scope_type,scope_value FROM archived_event_scopes;'

Files changed

desktop/src-tauri/src/archive/mod.rs        (Tauri commands + ephemeral validation + tests)
desktop/src-tauri/src/archive/pipeline.rs   (plan_archive / query_buckets / commit_archive)
desktop/src-tauri/src/archive/store.rs      (SQLite schema + CRUD)
desktop/src/shared/api/tauriArchive.ts      (API wrappers + kinds decoder + change notifier)
desktop/src/features/local-archive/archiveSyncManager.ts     (live forwarding manager)
desktop/src/features/local-archive/archiveSyncManager.test.mjs
desktop/src/features/local-archive/ui/LocalArchiveSettingsCard.tsx
desktop/src/features/settings/ui/SettingsPanels.tsx  (local-archive section)
desktop/src/features/settings/ui/SettingsView.tsx    (sidebar nav)
desktop/src/app/AppShell.tsx                         (useArchiveSync mount)