spike(block2): de-risk web of trust — the last big unknown

Adds TrustTransport as the third interface on the shared NostrConnection,
completing the social-layer happy path in the spike:

- WebOfTrust: pure, Flutter-free Duniter membership rule (N certs from members +
  within distance D of bootstrap referents), iterated to a fixpoint. The
  commons_core-worthy piece; TDD'd (threshold, distance cutoff, transitive
  growth, expired/revoked/self exclusion).
- NostrTrustTransport: certifications as a custom addressable kind (30777,
  keyed by issuer+subject) — certify renews, revoke replaces, certs expire.
- Trust filters spam (network-trust §2): seeds certify Alice; Eve stays
  uncertified; Bob discovers both offers and annotates authors — Alice known,
  Eve unknown — all over ONE shared connection.

Findings updated: WoT risk High -> Medium (policy/bootstrap, not feasibility);
overall scope Medium-High -> Medium — all three transport contracts now proven.
30 tests green, analyzer clean, Block 1 untouched.

spike/block2_spike/lib/block2_spike.dart

@@ -12,5 +12,8 @@ export 'src/nostr_event.dart';
 export 'src/nostr_key.dart';
 export 'src/nostr_message_transport.dart';
 export 'src/nostr_offer_transport.dart';
+export 'src/nostr_trust_transport.dart';
 export 'src/offer.dart';
 export 'src/offer_transport.dart';
+export 'src/trust_transport.dart';
+export 'src/web_of_trust.dart';