[Rewrite P6] Hardening: fuzz, benchmark gate, 72h soak, security review #868

Parent: #860
Milestone: Phase 6: Hardening + benchmark
Host: both · Expected cost: $1,200

Prove the rewrite before cutover: security review, the benchmark gate, and the long-run soak.

• Six-lens factory review of the whole nostream-relay + nostream-storage surface (security, architecture, performance at minimum; code/UX on the admin+MCP surface)
• Fuzzing: cargo-fuzz targets on the message parser, filter parser, NIP-11 doc generator, settings loader — 24h fuzz run on tauceti, zero crashes (crashes found → issues → re-fuzz)
• Benchmark gate (chappie rig, from [Rewrite P3] Storage seam + LMDB backend (strfry-style) + PG→LMDB migration #864's baseline): LMDB backend within 1.5× of Postgres on REQ p95 latency, ≥ 1× on ingest throughput, at 1M and 10M event corpora; results published in docs/rewrite/benchmarks.md
• Soak: 72h run on tauceti under synthetic load (mixed subscribe/event/COUNT/negentropy traffic, restarts injected) — memory flat, no fd leaks, event-store checksums stable across restarts
• Security review of the new surface: the MCP auth model, the settings surface, the migration tool (it holds DB credentials), LMDB file permissions
• Docs: docs/rewrite/ completed — architecture map TS→Rust crate, deployment guide, operator migration runbook

Acceptance: fuzz clean, benchmark gate green, soak green with published evidence, review lenses PASS, docs complete.