Every event kind the forge emits is classified for its audience, and a test fails on one that is not #3612

For: private by default. eventAudience in src/core/event_audience.ts sends an event of an unclassified kind to every reader. Two pulls this week (#3565, #3568) added events that carried private configuration (an upstream URL, an app's private address:port) and would have leaked them that way.

Done:

• [ ] eventAudience lists the kinds that are for readers explicitly, beside the admins, actor and app lists. An unknown kind is admins, never readers.
• [ ] A new test/event-audience-coverage.test.ts collects every event kind the source emits (the literal kinds passed to the outbox's emit in src/) and fails, naming the kind, when one is not in any list.
• [ ] Every kind that reaches readers today still does, which the existing outbox, stream and feed tests prove. Any kind this moves to admins is named in the pull, with why.

Files: src/core/event_audience.ts, test/event-audience-coverage.test.ts. Risk: a reader-facing kind built from a template string is missed by the scan and silently becomes admins-only. The scan must fail on a kind it cannot read literally, not skip it.