fix(restore): bound blob processing + negative-cache permanent decrypt failures (GH #501)

[harrymove-ctrl]

Summary

restore() discovers Walrus Blob objects by current on-chain ownership only, never by who created/uploaded them. A blob transferred into a victim's wallet by an attacker (carrying memwal_* metadata) gets downloaded and SEAL-decrypt-attempted on every future restore() call, forever — a failed decrypt/validation was never recorded anywhere, so the same foreign blob keeps getting rediscovered and reprocessed indefinitely.

Per Henry's explicit direction on this thread (an uploader/relayer allowlist would break the self-host-then-migrate-to-managed-relayer path and is expensive/fragile to implement), this fixes it with bounded processing + rate limiting instead:

• Negative cache: new restore_failed_blobs table. A blob that fails SEAL decrypt (classified via the existing DecryptOutcome::permanent_from_error) or UTF-8 validation for a given (owner, namespace, blob_id) is excluded from future restore() calls. Transient failures (timeouts, 429/503) are never cached, so an infra blip can't permanently blacklist a legitimate blob.
• Clamped limit: RestoreRequest.limit is now capped at 100, matching /api/ask's existing convention. It was previously unbounded on the Rust side (the only real ceiling was an incidental sidecar constant unrelated to this parameter).
• Owner-scoped rate limit: new check_restore_call_rate_limit (default 10/min/owner), reusing the existing Redis sliding-window primitive in rate_limit.rs, on top of the generic account limiter — bounds how often an attacker can force a fresh first-time-discovery cost by repeatedly transferring junk blob_ids into a victim's wallet.
• Fixed a pre-existing bug found during review: permanent_from_error's timeout check matched the sidecar's timeoutMs= config echo (present on every composed error), so it misclassified essentially all real decrypt failures — including the exact NoAccessError this fix depends on — as transient. Tightened the timeout signal and added NoAccessError to the permanent list, with tests pinning the actual wire format.

None of this inspects, records, or restricts who uploaded/created/relayed a blob — it's keyed purely by (owner, blob_id) outcome and owner-level call frequency. The self-host-then-migrate-to-managed-relayer path is untouched.

Fixes WALM-299 / GH #501.

Test plan

• cargo build — clean
• cargo test --bin memwal-server — 412 passed, 5 failed (pre-existing, unrelated jobs::tests::*, fail only due to no local Postgres in this sandbox — PoolTimedOut), 31 ignored
• New unit tests for the negative-cache round-trip, the NoAccessError/timeout classifier fix, and the limit clamp all pass
• DB-gated and Redis-gated integration tests could not be exercised locally (no live Postgres/Redis in this environment) — need a run against a real dev DB/Redis before merge
• Manual PoC replay against the original WALM-299 repro (attacker blob transferred to victim, victim restores twice) not yet performed