security: enforce /relay/ping pubkey binding and nonce replay rejection (Issue #48)

[AdnanMehr8]

This PR provides a clean, conflict-free implementation of the security fixes requested in Issue #48:

1. Nonce replay protection: Implemented using a SQLite-backed window.
2. Pubkey identity binding: Enforces that heartbeats match the registered key for bcn_ agents.
3. SwarmHub Compatibility: Includes the fix to avoid rejecting SwarmHub agents.
4. Input validation: Hardened hex/length checks on registration paths.

Replaces dirty PR #65.

[Scottcjn]

Closing as duplicate — PR #65 by autonomy414941 addresses the same issue (#48) and was submitted first. Thanks for the contribution.