feat(federation): pass explicit intent at every ensurePeered call site

- social.ts friend-add: user_action, with 409 peer_pending_local_admin
  when gate fires
- /peer/ensure: user_action, surfaces peeringStatus: 'admin_required'
- sendCallRelay (typing warm-up + call relay): system intent
- federationWorker resolvePendingPeers: system intent (defensive — gate
  is unreachable from here since pending rows already exist)
- CallRelayFailureReason: peer_admin_required added (mapped to
  peer_transient_failure on the user-facing event surface, since system
  intent should never legitimately surface admin_required)
- Test files: thread intent arg through racePeering and ensurePeered
  calls (positional shift from racePeering signature change)
- outboundGate.test.ts: tighten noUncheckedIndexedAccess access via
  non-null assertions after toHaveLength()
- docs/systems/social.md: peer_pending_local_admin error code documented

packages/server/src/utils/federationPeering.approvalToken.test.ts

@@ -101,7 +101,7 @@ describe('performHandshake — approval token capture & clear', () => {
     );
 
     const { ensurePeered } = await import('./federationPeering.js');
-    const result = await ensurePeered('https://remote.example');
+    const result = await ensurePeered('https://remote.example', { kind: 'system' });
 
     expect(result.status).toBe('pending');
 
@@ -120,7 +120,7 @@ describe('performHandshake — approval token capture & clear', () => {
     );
 
     const { ensurePeered } = await import('./federationPeering.js');
-    const result = await ensurePeered('https://legacy.example');
+    const result = await ensurePeered('https://legacy.example', { kind: 'system' });
 
     expect(result.status).toBe('pending');
     const peer = testDb.select().from(schema.federationPeers)
@@ -135,7 +135,7 @@ describe('performHandshake — approval token capture & clear', () => {
     );
 
     const { ensurePeered } = await import('./federationPeering.js');
-    const result = await ensurePeered('https://empty.example');
+    const result = await ensurePeered('https://empty.example', { kind: 'system' });
 
     expect(result.status).toBe('pending');
     const peer = testDb.select().from(schema.federationPeers)
@@ -161,7 +161,7 @@ describe('performHandshake — approval token capture & clear', () => {
     );
 
     const { ensurePeered } = await import('./federationPeering.js');
-    const result = await ensurePeered('https://remote.example');
+    const result = await ensurePeered('https://remote.example', { kind: 'system' });
     expect(result.status).toBe('active');
 
     const peer = testDb.select().from(schema.federationPeers)