feat(relay): automatic storm/replay quarantine with auto-release

[iceice400]

Summary

• Adds memory-only storm/replay quarantine under relay.storm_guard — detects identical packet_id bursts or high per-node packet rates in a rolling window and temporarily blocks relay TX (feed unchanged)
• Operator API: GET /api/relay/quarantine, POST .../release, POST .../blocklist (promote to permanent blocklist + hot-reload)
• Dashboard: amber countdown badge on node cards; quarantine panel in Configuration → Advanced

Risks / notes

• False positives: busy legitimate nodes can trip rate_threshold_per_minute — tune for your mesh density
• Memory-only: quarantine state is not persisted to SQLite; auto-release after quarantine_duration_seconds
• Filter order: blocklist → storm quarantine → dedup/rate/channel — documented in CONFIGURATION.md
• Does not change native TX or packet capture — relay reject reason storm_quarantined only

Dependency

Stacks on PR #71 (relay filter controls). Merge #71 first, then rebase this branch onto main if needed.

Test plan

• python -m unittest tests.test_storm_guard tests.test_relay_filters -v (14 pass, 4 skipped — jwt)
• Enable relay.storm_guard.enabled: true on test Pi; trigger replay storm from fast TX node
• Verify amber badge + countdown on node card; release early and promote-to-blocklist from Advanced panel
• Confirm quarantined node still appears in live feed but relay stats show storm_quarantined rejections