feat(federation): pass explicit intent at every ensurePeered call site

- social.ts friend-add: user_action, with 409 peer_pending_local_admin
  when gate fires
- /peer/ensure: user_action, surfaces peeringStatus: 'admin_required'
- sendCallRelay (typing warm-up + call relay): system intent
- federationWorker resolvePendingPeers: system intent (defensive — gate
  is unreachable from here since pending rows already exist)
- CallRelayFailureReason: peer_admin_required added (mapped to
  peer_transient_failure on the user-facing event surface, since system
  intent should never legitimately surface admin_required)
- Test files: thread intent arg through racePeering and ensurePeered
  calls (positional shift from racePeering signature change)
- outboundGate.test.ts: tighten noUncheckedIndexedAccess access via
  non-null assertions after toHaveLength()
- docs/systems/social.md: peer_pending_local_admin error code documented

packages/server/src/utils/federationPeering.trustGuard.test.ts

@@ -103,7 +103,7 @@ describe('ensurePeered — refuses when unresolved inbound approval-request exis
 
     const { ensurePeered, _clearInFlightPeering } = await import('./federationPeering.js');
     _clearInFlightPeering();
-    const result = await ensurePeered('https://orbit.test');
+    const result = await ensurePeered('https://orbit.test', { kind: 'system' });
 
     expect(result.status).toBe('rejected');
     if (result.status === 'rejected') {
@@ -126,7 +126,7 @@ describe('ensurePeered — refuses when unresolved inbound approval-request exis
 
     const { ensurePeered, _clearInFlightPeering } = await import('./federationPeering.js');
     _clearInFlightPeering();
-    const result = await ensurePeered('https://nopeer.test');
+    const result = await ensurePeered('https://nopeer.test', { kind: 'system' });
 
     // Reached performHandshake — failure mode is 'failed' (network), NOT
     // the pre-handshake 'rejected' from the new guard.