fix(config): fail closed on POW_REQUIRED without FEATURE_POW; harden premium key check

- Reject boot when POW_REQUIRED (or the per-pubkey PoW list) is set while
  FEATURE_POW is off: the gate would silently never apply and /capabilities
  would report pow_required:false — a signup endpoint the operator believes
  is protected but isn't.
- Validate the premium PAYMENT_API_KEY through the same require_secret path
  the pay-to-register flow uses, so a placeholder key cannot reach production.
- Advertise the premium-post write policy in MessagingCapability and
  regenerate openapi.json to match.
- Give the premium integration fixtures unique per-run ids so the suite is
  re-runnable against a persistent local test database.

src/api/capabilities.rs

@@ -60,7 +60,7 @@ pub struct FeatureCapabilities {
 pub struct MessagingCapability {
     /// The ws(s):// relay URL clients connect to.
     pub relay_url: String,
-    /// Write policy: `inbox-outbox` | `author-allowlist` | `open`.
+    /// Write policy: `inbox-outbox` | `author-allowlist` | `open` | `premium-post`.
     pub write_policy: String,
     /// NIP-13 PoW bits required on cross-ecosystem inbound (0 = off).
     pub inbound_pow_bits: u8,