Add curation ACL mode and complete graph query implementation (v0.47.0)

Curation Mode:
- Three-tier publisher classification: Trusted, Blacklisted, Unclassified
- Per-pubkey rate limiting (default 50/day) for unclassified users
- IP flood protection (default 500/day) with automatic banning
- Event kind allow-listing via categories, ranges, and custom kinds
- Query filtering hides blacklisted pubkey events (admin/owner exempt)
- Web UI for managing trusted/blacklisted pubkeys and configuration
- NIP-86 API endpoints for all curation management operations

Graph Query Extension:
- Complete reference aggregation for Badger and Neo4j backends
- E-tag graph backfill migration (v8) runs automatically on startup
- Configuration options: ORLY_GRAPH_QUERIES_ENABLED, MAX_DEPTH, etc.
- NIP-11 advertisement of graph query capabilities

Files modified:
- app/handle-nip86-curating.go: NIP-86 curation API handlers (new)
- app/web/src/CurationView.svelte: Curation management UI (new)
- app/web/src/kindCategories.js: Kind category definitions (new)
- pkg/acl/curating.go: Curating ACL implementation (new)
- pkg/database/curating-acl.go: Database layer for curation (new)
- pkg/neo4j/graph-refs.go: Neo4j ref collection (new)
- pkg/database/migrations.go: E-tag graph backfill migration
- pkg/protocol/graph/executor.go: Reference aggregation support
- app/handle-event.go: Curation config event processing
- app/handle-req.go: Blacklist filtering for queries
- docs/GRAPH_QUERIES_REMAINING_PLAN.md: Updated completion status

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/main.go

@@ -135,8 +135,8 @@ func Run(
 		}
 	}
 
-	// Initialize graph query executor (Badger backend)
-	if badgerDB, ok := db.(*database.D); ok {
+	// Initialize graph query executor (Badger backend) if enabled
+	if badgerDB, ok := db.(*database.D); ok && cfg.GraphQueriesEnabled {
 		// Get relay identity key for signing graph query responses
 		relaySecretKey, err := badgerDB.GetOrCreateRelayIdentitySecret()
 		if err != nil {
@@ -147,13 +147,15 @@ func Run(
 			if l.graphExecutor, err = graph.NewExecutor(graphAdapter, relaySecretKey); err != nil {
 				log.E.F("failed to create graph executor: %v", err)
 			} else {
-				log.I.F("graph query executor initialized (Badger backend)")
+				graphEnabled, maxDepth, maxResults, rateLimitRPM := cfg.GetGraphConfigValues()
+				log.I.F("graph query executor initialized (Badger backend, enabled=%v, max_depth=%d, max_results=%d, rate_limit=%d/min)",
+					graphEnabled, maxDepth, maxResults, rateLimitRPM)
 			}
 		}
 	}
 
-	// Initialize graph query executor (Neo4j backend)
-	if neo4jDB, ok := db.(*neo4j.N); ok {
+	// Initialize graph query executor (Neo4j backend) if enabled
+	if neo4jDB, ok := db.(*neo4j.N); ok && cfg.GraphQueriesEnabled {
 		// Get relay identity key for signing graph query responses
 		relaySecretKey, err := neo4jDB.GetOrCreateRelayIdentitySecret()
 		if err != nil {
@@ -164,7 +166,9 @@ func Run(
 			if l.graphExecutor, err = graph.NewExecutor(graphAdapter, relaySecretKey); err != nil {
 				log.E.F("failed to create graph executor: %v", err)
 			} else {
-				log.I.F("graph query executor initialized (Neo4j backend)")
+				graphEnabled, maxDepth, maxResults, rateLimitRPM := cfg.GetGraphConfigValues()
+				log.I.F("graph query executor initialized (Neo4j backend, enabled=%v, max_depth=%d, max_results=%d, rate_limit=%d/min)",
+					graphEnabled, maxDepth, maxResults, rateLimitRPM)
 			}
 		}
 	}