…us, bridge mux

Relax the ANCHOR binding's address check under explicit publisher
regimes per SWIP-60 (the SOC id does no protocol work there; legitimacy
is list membership), add the FEED_TOPIC binding with FeedID derivation
(keccak256(topic || 8-byte BE index), dedup on chunk address), expose
per-topic Status() introspection, and add the Bridge: a per-topic mux
sharing one p2p session among N local sinks with role upgrade, slow-sink
drop and full teardown ownership. Also fixes a slice-sizing data race in
Status() and documents the revised subscriber trust caveat.

feat(api): pubsub websocket bridge

Add GET /pubsub/{topic} (WebSocket session on a topic: cohort
parameters in the query make the session the opener, owner makes it a
publisher; swarm-keep-alive, swarm-soc-fields and
swarm-cache-wrapped-chunk headers) and GET /pubsub (active topic
listing). Inbound frames are sig||span||payload (anchor, id = topic) or
index||sig||span||payload (feed, id = keccak256(topic || index)),
assembled and signature-authenticated node-side against the cohort spec
- the node holds no publisher keys. Includes SWIP-60 conformance
end-to-end tests: jam cohort, live feed stream with dedup, and
FULL-refusal with a wire-level Hello/Ack-only assertion.

feat(node): wire bps service and bridge

Construct the bps service and bridge in the node bootstrap, register
the broker protocol on full nodes only, expose the bridge to the API,
register metrics, close on shutdown, and add the pubsub-capacity flag
(default 32) for the per-topic broker stream limit.

docs(openapi): document pubsub endpoints

Add /pubsub and /pubsub/{topic} to the Swarm API spec (8.1.0 -> 8.2.0)
with the cohort query parameters, the swarm-keep-alive, swarm-soc-fields
and swarm-cache-wrapped-chunk headers, publish frame formats, and the
subscriber trust caveat.