feat(cli): scope message search to one channel

[sumit-m]

Problem

buzz messages search is community-wide only. There is no way to search within
a single channel, so the common case — "what was said about X here" — has to be
done by fetching pages of messages get and grepping, or by searching everything
and filtering by hand.

This matters most for agents. An agent whose context window has been truncated
knows its channel id and nothing else; without channel scoping it cannot look up
its own recent history.

Change

Adds --channel <UUID> to buzz messages search. It becomes an #h tag on the
NIP-50 filter.

buzz messages search --channel <UUID> --query checkout

No relay work. api/bridge.rs already reads #h off a search filter,
intersects the values with the caller's accessible channels, and skips the filter
entirely when none survive. The flag narrows results; it is never the access
boundary. An id the caller cannot read returns an empty list, exactly as if the
channel were empty.

--channel is validated with validate_uuid before any network call, so a
malformed id exits 1 with {"error":"user_error","message":"invalid UUID: …"}
rather than producing a confusing empty result.

Tests

cmd_search needs a live client, so the filter construction is extracted into a
pure build_search_filter and unit-tested — scoped, unscoped, and combined with
--author/--since. That matches the existing convention in this module
(pure helper + unit test).

Verification

End-to-end against a local relay with three generated identities:

Check	Result
Unscoped search	finds messages in both test channels
--channel A	finds only channel A's message
Identity 1 → identity 2's private channel	[]
Scoped to a DM channel id	only the DM message
Non-participant → that DM	[]

The private-channel case was checked both ways: the scoped search returned [],
and the same identity's unscoped search did not contain the message either —
so the ACL is doing the work, not the flag. The non-participant's unscoped search
still returned the two open channels, confirming correct visibility rather than
blanket denial.

DMs needed no special handling: they are ordinary messages tagged
h=<channel-id>, so channel scoping and the ACL apply unchanged.