feat: accept wardriver/hunter stream regions and gate their delivery

[Elektr0Vodka]

What

Accept non-IATA stream-region labels in the topic region slot, alongside real IATA codes and test.

A browser-based wardrive publisher publishes to meshcore/{region}/{PUBKEY}/wardriver/{obs,track}, where {region} is a stream label (wardriver, hunter) chosen so this traffic stays separable from regional observer traffic. Today authorizePublish requires that slot to be a 3-letter IATA code or literally test; anything else is rejected and the client is closed. Because these publishes are QoS 0 there is no nack, so a publisher's "sent" counter climbs while the broker silently drops everything.

Changes

• PUBLISH_EXTRA_REGIONS (new env, comma-separated, lowercase; defaults to wardriver,hunter). Labels in this set are accepted as publish regions: they skip IATA validation but keep every other check — the pubkey-in-topic must equal the authenticated JWT pubkey, and the topic is still normalized. Stream labels are kept lowercase (IATA normalizes to uppercase, test to lowercase). Set it explicitly (even empty) to override.
• Delivery gating. authorizeForward now blocks /wardriver/* topics for LIMITED (role 3) subscribers. These streams carry realtime location, so only FULL_ACCESS (2) and ADMIN (1) receive them — mirroring the existing /internal and /serial blocks.

Notes

• Auth model is unchanged: companion-signed JWT, AUTH_EXPECTED_AUDIENCE = the hostname the publisher connects to.
• An ingestor that needs /wardriver/* must be role >= FULL_ACCESS (2).
• tsc --noEmit clean.