test: nothing asserts that expiry withholds a stored event from a reader #1107

No test asserts that a stored event whose NIP-40 expires_at has passed is withheld from a subscriber, so the guard in handlers/subscribe.rs can regress silently. This is the reason #953 went unnoticed: the clock is captured once, at subscribe.rs:306, and consumed per event at :381, while the await that opens the window is stream.next() at :364 over lazily-read LMDB batches — an event expiring mid-stream is delivered — and nothing in the suite would have failed.

What exists today is not that assertion:

• crates/nostream-relay/tests/strategies.rs:1061 group_accepts_an_expiration_tag_alongside_the_h_tag checks a write, not a withheld read;
• the only other expires_at in that file, at :1416, is a fixture field set to None.

The Clock seam is what makes such a test possible (HandlerContext.clock, TestClock advancing between permits); #1106 is the storage side of the same gap, where two LMDB query entries read Utc::now() and so cannot be driven by a test clock at all.

Acceptance: a relay test that stores a far-future expires_at, advances the test clock past it between two fixture permits, and asserts the second read delivers nothing — red at 2c151f2a, green with #953's fix.