fix(security): prevent notifications from blocked users [BCH-01-012]

Block notifications from bypassing the user blocking feature on iOS.

Vulnerabilities fixed:
1. Nostr public messages: checkForMentions() was called regardless of
   blocking status, allowing blocked users to trigger mention notifications
2. Noise-encrypted DMs: didReceiveNoisePayload() didn't check blocking
   before calling handlePrivateMessage(), allowing DM notifications

Changes:
- ChatViewModel+Nostr.swift: Add blocking check before checkForMentions()
  and sendHapticFeedback() in subscribeNostrEvent
- ChatViewModel.swift: Add isPeerBlocked() check in didReceiveNoisePayload
  before processing private messages
- Add NotificationBlockingTests.swift with 5 tests for blocking behavior

Security: Blocked users can no longer trigger notifications through any
message path (Nostr public, Nostr DM, or BLE Noise DM).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

bitchat/ViewModels/Extensions/ChatViewModel+Nostr.swift

@@ -130,12 +130,21 @@ extension ChatViewModel {
             mentions: mentions.isEmpty ? nil : mentions
         )
         Task { @MainActor in
+            // BCH-01-012: Check blocking before any notifications
+            // handlePublicMessage has its own blocking check but returns silently,
+            // so we must also guard checkForMentions to prevent notification bypass
+            let isBlocked = identityManager.isNostrBlocked(pubkeyHexLowercased: event.pubkey.lowercased())
+
             handlePublicMessage(msg)
-            checkForMentions(msg)
-            sendHapticFeedback(for: msg)
+
+            // Only check mentions and send haptic if sender is not blocked
+            if !isBlocked {
+                checkForMentions(msg)
+                sendHapticFeedback(for: msg)
+            }
         }
     }
-    
+
     func subscribeGiftWrap(_ giftWrap: NostrEvent, id: NostrIdentity) {
         guard !deduplicationService.hasProcessedNostrEvent(giftWrap.id) else { return }
         deduplicationService.recordNostrEvent(giftWrap.id)