feat: age-restrict effect for media moderation

[mbradley]

Summary

• new AgeRestrictNostrEvent UDF + AgeRestrictEffect effect type, follows the BanNostrEvent pattern
• RelayManagerSink handles AgeRestrictEffect by calling /api/moderate-media with AGE_RESTRICTED action + sha256 hash
• label_routing.sml wires ConfirmedNudity and ConfirmedViolence rules to fire AgeRestrictNostrEvent using the label's LabelContentHash
• rules guarded on LabelContentHash != '' so they only fire when a media hash is present in the label event

Test plan

• verify SML rules compile (divine-integration-tests CI)
• deploy to staging after PR feat: multi-report threshold escalation + enforcement label publishing #7 (multi-report rules) lands
• publish a kind 1985 label with sha256 metadata on staging, confirm age-restrict call reaches relay-manager
• confirm labels without sha256 do NOT trigger the age-restrict path

[mbradley]

slowing our roll on this one. preceding work needs to land and operating state on staging needs to be confirmed first:

• osprey PR feat: multi-report threshold escalation + enforcement label publishing #7 (multi-report rules + bridge contract fixes) awaiting re-review
• iac-coreconfig PR #608 (COOP manifests) + coop PR feat: Divine Osprey integration — ClickHouse, SML rules, CI #1 (CI) need devops review
• GCP secrets for staging need to be populated

once the pipeline is running end-to-end on staging and we can validate verdicts transparently, this is the next piece to wire up.