feat(federation): pass explicit intent at every ensurePeered call site

- social.ts friend-add: user_action, with 409 peer_pending_local_admin
  when gate fires
- /peer/ensure: user_action, surfaces peeringStatus: 'admin_required'
- sendCallRelay (typing warm-up + call relay): system intent
- federationWorker resolvePendingPeers: system intent (defensive — gate
  is unreachable from here since pending rows already exist)
- CallRelayFailureReason: peer_admin_required added (mapped to
  peer_transient_failure on the user-facing event surface, since system
  intent should never legitimately surface admin_required)
- Test files: thread intent arg through racePeering and ensurePeered
  calls (positional shift from racePeering signature change)
- outboundGate.test.ts: tighten noUncheckedIndexedAccess access via
  non-null assertions after toHaveLength()
- docs/systems/social.md: peer_pending_local_admin error code documented

packages/server/src/routes/social.ts

@@ -178,7 +178,12 @@ async function handleFederatedFriendRequest(
   }
 
   // 2. ensurePeered — block until 'active', or surface peer status as error
-  const peering = await ensurePeered(peerOrigin);
+  const peering = await ensurePeered(peerOrigin, {
+    kind: 'user_action',
+    userId: sender.id,
+    reason: 'friend_add',
+    target: `${baseName}@${targetDomain}`,
+  });
   if (peering.status === 'rejected') {
     return reply.code(403).send({ error: 'peer_rejected', statusCode: 403, domain: targetDomain });
   }
@@ -195,6 +200,13 @@ async function handleFederatedFriendRequest(
     }
     return reply.code(409).send({ error: 'peer_pending', statusCode: 409, domain: targetDomain });
   }
+  if (peering.status === 'admin_required') {
+    return reply.code(409).send({
+      error: 'peer_pending_local_admin',
+      statusCode: 409,
+      domain: targetDomain,
+    });
+  }
   // peering.status === 'active' — continue
 
   // 3. Lookup