fix: require authority key for browser p2p headlines

[mosure]

Motivation

• Browser peers accepted any self-signed StoryCapsule on subscribed gossipsub topics, allowing unauthenticated peers to inject live headlines that would appear "verified" in the UI.
• The new WSS handoff made a public gossipsub peer reachable from browsers without enforcing the edge authority identity on received capsules.

Description

• Add authority_id to BrowserPeerStartConfig so the browser runtime has an expected signing authority (crates/agent_feed_p2p_browser/src/lib.rs).
• Harden handle_story_message to reject incoming capsules whose signed.signature.key_id does not match the configured authority_id (after verify_capsule() and before converting to a RemoteFeedHeadline) (crates/agent_feed_p2p_browser/src/lib.rs).
• Plumb the authority key id into the browser peer start config in the UI using the signed browser seed signature key id (crates/agent_feed_ui/src/reel.ts).

Testing

• Attempted cargo test -p agent_feed_p2p_browser failed due to local toolchain mismatch (rustc 1.89.0 vs crate-required 1.95), so the non-ignored run could not execute.
• Ran cargo test -p agent_feed_p2p_browser --ignore-rust-version and all browser-p2p unit tests passed (13 passed; 0 failed).

---

Codex Task