Add curation ACL mode and complete graph query implementation (v0.47.0)

Curation Mode:
- Three-tier publisher classification: Trusted, Blacklisted, Unclassified
- Per-pubkey rate limiting (default 50/day) for unclassified users
- IP flood protection (default 500/day) with automatic banning
- Event kind allow-listing via categories, ranges, and custom kinds
- Query filtering hides blacklisted pubkey events (admin/owner exempt)
- Web UI for managing trusted/blacklisted pubkeys and configuration
- NIP-86 API endpoints for all curation management operations

Graph Query Extension:
- Complete reference aggregation for Badger and Neo4j backends
- E-tag graph backfill migration (v8) runs automatically on startup
- Configuration options: ORLY_GRAPH_QUERIES_ENABLED, MAX_DEPTH, etc.
- NIP-11 advertisement of graph query capabilities

Files modified:
- app/handle-nip86-curating.go: NIP-86 curation API handlers (new)
- app/web/src/CurationView.svelte: Curation management UI (new)
- app/web/src/kindCategories.js: Kind category definitions (new)
- pkg/acl/curating.go: Curating ACL implementation (new)
- pkg/database/curating-acl.go: Database layer for curation (new)
- pkg/neo4j/graph-refs.go: Neo4j ref collection (new)
- pkg/database/migrations.go: E-tag graph backfill migration
- pkg/protocol/graph/executor.go: Reference aggregation support
- app/handle-event.go: Curation config event processing
- app/handle-req.go: Blacklist filtering for queries
- docs/GRAPH_QUERIES_REMAINING_PLAN.md: Updated completion status

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

pkg/database/graph-adapter.go

@@ -38,5 +38,27 @@ func (a *GraphAdapter) TraverseThread(seedEventID []byte, maxDepth int, directio
 	return a.db.TraverseThread(seedEventID, maxDepth, direction)
 }
 
+// CollectInboundRefs implements graph.GraphDatabase.
+// It collects events that reference items in the result.
+func (a *GraphAdapter) CollectInboundRefs(result graph.GraphResultI, depth int, kinds []uint16) error {
+	// Type assert to get the concrete GraphResult
+	graphResult, ok := result.(*GraphResult)
+	if !ok {
+		return nil // Can't collect refs if we don't have a GraphResult
+	}
+	return a.db.AddInboundRefsToResult(graphResult, depth, kinds)
+}
+
+// CollectOutboundRefs implements graph.GraphDatabase.
+// It collects events referenced by items in the result.
+func (a *GraphAdapter) CollectOutboundRefs(result graph.GraphResultI, depth int, kinds []uint16) error {
+	// Type assert to get the concrete GraphResult
+	graphResult, ok := result.(*GraphResult)
+	if !ok {
+		return nil
+	}
+	return a.db.AddOutboundRefsToResult(graphResult, depth, kinds)
+}
+
 // Verify GraphAdapter implements graph.GraphDatabase
 var _ graph.GraphDatabase = (*GraphAdapter)(nil)